Breaches are inevitable even for well-resourced organizations. Discover why data-centric security, not another perimeter layer, is what limits the fallout when one occurs.
The security industry has spent two decades building higher walls. Firewalls. Endpoint detection. Zero Trust network access. Threat intelligence platforms. An arms race that consumes billions annually, and that adversaries keep winning anyway.
The organizations in the breach headlines are not careless. They are well resourced, well staffed, and doing exactly what the industry told them to do.
That is the problem worth sitting with.
Not every breach is a data breach, and pretending otherwise is how vendors lose the room.
SolarWinds was a compromise of a build system. Log4Shell was remote code execution. Neither would have been prevented by protecting customer records at the field level, and anyone who lived through them knows it. Data-centric security is not a universal control, and claiming it is invites the rebuttal it deserves.
But look at the breaches that actually emptied customer records into the wild. MOVEit. Capital One. Equifax. In each case the adversary reached a store of sensitive data and took it in usable form. The exfiltration was the event.
That is the class of breach where the data layer is the deciding factor, and it is the most common class by volume.
A zero-day is, by definition, unknown until it is exploited. No signature catches it. No patch exists. The adversary holds information your entire security stack does not.
Zero-days are just the headline. Misconfigurations, supply chain compromises, credential theft, insider threats. The modern enterprise attack surface is vast, distributed, and impossible to fully harden. Every SaaS integration your team uses is a trust relationship you do not fully control.
Detection has genuinely improved. Median dwell time has fallen from the months reported a decade ago to roughly ten days in recent industry reporting. That is real progress and worth acknowledging. It is also not a solution. Ten days is more than enough time to locate a database and copy it.
The question that matters is not how do we stop every attacker from getting in. It is: if an attacker gets in, what can they actually do with what they find?
Zero Trust deserves credit here rather than a strawman. Its founding premise is exactly the one this argument rests on: assume compromise, verify continuously, constrain blast radius. Zero trust practitioners were early to the conclusion that prevention alone fails.
The limitation is one of layer, not logic. Zero Trust constrains blast radius at the access layer. It governs who can reach what. It does not govern what the data is worth once reached. A correctly scoped, continuously verified session that legitimately touches a customer table still returns cleartext to whoever holds that session.
Data-centric security applies the same assume-compromise logic one layer down. If sensitive values are tokenized at the field level, a compromised session returns tokens. Not because access control failed or succeeded, but because there was nothing usable to return.
The breach happened. The data was not compromised. These are not contradictory outcomes. With data-centric protection, they are the design.
This distinction gets glossed over and it should not be. Encryption hides a value. Tokenization replaces it.
Ciphertext is a mathematical derivative of the plaintext. Recover the key and the original is recoverable. A vaulted token is not a transformation at all. It is a randomly generated reference to a value held separately. There is no algorithm that turns a token back into the original, and no key that unlocks it, because there is nothing inside it to unlock. Reversal requires live, authenticated access to the vault, which is a real time operation that leaves logs.
Three limits worth naming, because a control you cannot describe honestly is a control nobody should buy.
Tokenization does not stop ransomware from encrypting or destroying your systems. It protects confidentiality, not availability. It does not stop remote code execution, and it does not stop an adversary who compromises an application session that is authorized to detokenize. And the vault becomes infrastructure you have to run properly, which is a genuine operational commitment rather than a footnote.
What it does is remove the payoff from the most common outcome: bulk exfiltration of records at rest.
Regulators have been arriving at the same conclusion. PCI DSS 4.0, NIST guidance, and GDPR's accountability framework all push toward demonstrating that sensitive data is protected at the field level, not merely that the network is hardened.
Canada is now moving the same way. Bill C-36, introduced June 15, 2026, would enact the Protecting Privacy and Consumer Data Act and replace the privacy provisions of the Personal Information Protection and Electronic Documents Act (PIPEDA). It carries administrative monetary penalties up to $10 million or 3 percent of global revenue, whichever is greater, and fines up to $25 million or 5 percent for the most serious offences, administered by a new Digital Safety and Data Protection Commission of Canada. The bill is at first reading and will change before it passes. The direction will not.
An organization that suffers a breach and can demonstrate that no sensitive data was exposed sits in a categorically different legal and reputational position than one facing the same breach with cleartext on the other end.
Breaches will happen. Zero-days will be exploited. None of this is a reason to stop investing in detection and response. Those investments matter and prevent real damage every day.
But when they fail, and periodically they will, the only thing standing between an incident and a disclosure is what the attacker actually walked out with.
Design for that outcome specifically, and be honest about what it does and does not cover.
Ed Leavens is the Chief Strategic Officer, co-founder and former CEO at DataStealth.io and a cybersecurity innovator.
