The Foundation for Defense of Democracies (FDD) warned that encryption alone cannot adequately protect sensitive data as it moves across cloud platforms, third-party vendors, backup systems, analytics tools and artificial intelligence (AI) pipelines. Georgianna Shea, chief technologist at FDD’s Center on Cyber and Technology Innovation and its Transformative Cyber Innovation Lab, recognized that data becomes vulnerable when authorized systems decrypt it for processing, leaving sensitive information exposed to theft or misuse. Each transfer, copy or handoff creates additional opportunities for information to be mishandled or stolen, highlighting gaps in conventional cybersecurity approaches that focus primarily on securing systems, restricting access and preventing intrusions.
Shea advocated for broader evaluation of vaultless, keyless pseudonymization, a method that replaces sensitive information with realistic substitutes while preserving the data formats required for legitimate processing.
An assessment by FDD’s Transformative Cyber Innovation Lab found that unauthorized attempts to restore original values failed and were logged, while restoration authorized by multiple parties returned the correct values. The approach also allowed access to pseudonymized tokens to be revoked, limiting downstream re-identification. Shea urged the U.S. National Institute of Standards and Technology and the National Security Agency to evaluate the technology’s security benefits, risks and operational requirements, while calling for stronger procurement scrutiny of vendors’ data-protection claims.
“Hospitals, banks, defense contractors and government agencies cannot operate on permanently unreadable data. They need to process records, share information, analyze intelligence and prepare data for artificial intelligence models,” Shea wrote in her recent analysis. “The reality is data moves. It travels through cloud platforms, vendors, backups, analytics tools, payment processors, software services, AI pipelines, and partner systems. Every handoff creates another place where information can be copied, cached, logged, and indexed, and another place where it can be mishandled or stolen.”
She noted that this is the gap encryption does not close.
“Encryption protects data when it is stored or traveling, only partially protects it when it is transmitted, and does not protect data at all when it is processed. Once an authorized system decrypts information so someone can use it, the data becomes readable again,” Shea added. “The defenses have not reduced the sensitivity of the information. If an adversary steals unencrypted data — or decrypts stolen data at a later date when quantum computers are readily available — the adversary now has the sensitive information. All told, encryption is essential, but it’s also not enough. Washington needs to take that seriously.”
She proposed one promising answer is vaultless, keyless pseudonymization. The phrase sounds technical, but the idea is straightforward: replace sensitive values with realistic substitutes before the data spreads.
“Vaultless, keyless pseudonymization is designed to remove the single point of failure created by a central vault or master key,” according to Shea. “In a model assessed by our Transformative Cyber Innovation Lab at the Foundation for Defense of Democracies, the protected data could be restored only when the required parties authorized it under controlled conditions; no one party could reverse the pseudonymized tokens on its own.”
She added that the test showed the approach could preserve the format of sensitive contents while limiting access to the real values behind them. “Unauthorized restoration attempts failed and were logged. Multi-party stakeholder authorized restoration returned the correct values. Intercepted tokens did not reveal the original data value. And the system contained a unique ability to revoke access to the token — regardless of where it exists — by cutting off downstream re-identification.”
Moreover, she added that the assessment showed promise that sensitive data could remain useful for legitimate work while becoming far less valuable to attackers and unauthorized users. Using vaultless, keyless pseudonymization can significantly reduce the impact of a data breach or ransomware attack if the stolen or exposed data has no intrinsic value.
Shea called upon the federal government to evaluate this methodology to assess what is required to make it work in live, real-world operations. Right now, agencies may be inclined to ignore this type of technology simply because it does not fit neatly into existing categories for encryption, access control, or other cybersecurity processes. This is a mistake.
“The National Institute of Standards and Technology should evaluate what the technology does, what risks it reduces, what new dependencies it introduces, and what evidence is required before it can be trusted in practice,” she added. “NSA should examine the same questions for classified networks. Procurement regulations should also get smarter. Vendors claiming tokenization, pseudonymization, data-layer protection or quantum-resilient properties should have to explain whether raw data enters their infrastructure, whether any token-to-source mapping exists, who can restore original values and what independent review has been completed.”
She added that cybersecurity policy has spent decades trying to keep attackers out. “That work will never end. But we need this second objective: make sensitive data less damaging when it inevitably escapes.”
