SECAI Core · phase 12 of 15
Data masking
A de-identification method where generic or placeholder labels are substituted for real data while preserving the structure or format of the original data. Also known as data obfuscation.
The Explain card
- Plain English
- Data masking replaces real values with generic or placeholder values that keep the same shape and format, so systems and tests still work but the sensitive content is gone. Also called data obfuscation.
- Example
- A development team needs realistic records to test an AI fraud model. Real card numbers become valid-looking fake ones, and real names become random names, so the pipeline runs identically without exposing customers.
- Why it matters
- Test, staging and training environments are usually less protected than production. Masking lets you build and evaluate AI systems there without handing attackers a copy of the crown jewels.
- Hook
- Same shape, fake filling: a mannequin in the window instead of the real thing.
Where it sits in the deck
Phase 12: Defensive Technologies and Secure Development Practices
Map defences directly to the attacks just catalogued — the technical controls, secure coding practices, and protective tools that harden AI and traditional systems alike.
