What if the data that was stolen wasn’t real, anyway?

Most enterprise leaders know the tabletop exercise: the dry run, the dress rehearsal for a cyber incident. Cyber insurers increasingly expect executive teams to run them, for the same reason schools run fire drills. You practise the response before the alarm is real.

On Wednesday, September 30, 2026, DataStealth and IBM took that idea a step further.

Together we hosted Cyber Resilience Under Pressure, a half day session at the uOttawa-IBM Cyber Range at the University of Ottawa. A room of senior executives ran a live breach simulation, then sat down with us to talk about what actually holds when sensitive data walks out the door.

Inside the Cyber Range

About 30 of us were in the range, and the space itself is remarkable. Every participant has a dedicated workstation with a screen and a phone, and the whole room is built to be interactive.

Over the course of the simulation, IBM puts you through your paces as a large enterprise under attack. Intruders are in the network. Data is leaving. The calls keep coming, and every decision has to be made with incomplete information and the clock running.

One thing I appreciate about working with IBM on these sessions is that they run them at very different altitudes.

Some simulations are deeply technical: attacker against defender, inside the systems.

Ours was built for the top of the organization.

The room was CEOs, CIOs, CISOs and business leaders from both the public and private sectors, most of them not technical by background, and that was the point. They brought what they knew, their own policies and a great deal of common sense, and worked the incident as a group.

It was high pressure and high stakes, and it was a lot of fun.

Flipping the panic on its head

After the simulation, IBM invited DataStealth to address the room, and the connection could not have been more direct.

Everyone had just lived through the panic of watching sensitive data (PCI, PII, PHI and confidential information) leave their organization in clear text. We got to ask a different question: what if what was stolen was never real data in the first place?

Ed Leavens, our Chief Strategy Officer and co-founder, walked the audience through why protecting data at rest and in motion on the wire is so critical to limiting the blast radius of a breach when it happens.

At DataStealth, we will never tell you that breaches don’t happen.

If we could stop every breach, I’d be retired. They are in the news every day, and they are happening to everyone.

So the question has to change from “how do we stop a breach?” to “how do we minimize the blast radius when it happens?”

Our answer is consistent: keep sensitive data living in a protected state.

That can mean tokenized, encrypted, masked or redacted, and we lean toward tokenization. A breach is still bad news. An adversary got into your environment and took data. But instead of my first name and surname, all they have is first name Apple, surname Banana.

What executives wanted to know: tokenization and quantum risk

Our presentation was followed by 20 to 30 minutes of questions from a highly engaged audience. Most of the organizations in the room already had protection in place, mainly file level and database level encryption.

What they wanted to understand was tokenization.

Why tokenize? What exactly is it? Is it vaulted or vaultless? Is it based on mathematics? Is it safe from quantum?

That last question is the one driving the conversation.

These executives told us plainly that quantum is the biggest threat to their data strategy right now. Adversaries are already running harvest now, decrypt later campaigns: collecting encrypted data today and holding it until quantum computers can break the encryption. Anyone holding data with a long shelf life (health records, financial history, citizen records, government files) is on that clock.

So is encryption enough?

Here is how we answered.

DataStealth tokenization is vault based substitution. Victoria becomes Apple. There is no mathematical relationship between the token and the original value, so there is nothing for a quantum computer to decrypt. Tokens are fully customizable: random or readable, letters, numbers or anything in between, in whatever format your systems expect.

The bottom line is that the data sits in a protected state that harvest now, decrypt later cannot touch.

We also spent a lot of time on referential integrity.

Tokenization is far more useful when Victoria McGlone becomes Apple Banana consistently across every system in the enterprise, not one token in one application and a different token downstream. Consistent tokens let analytics, joins and workflows keep running on protected data without breaking any downstream technologies.

Many of the questions came from large financial institutions and public sector organizations, and most of them centred on PII.

In Canada, pressure around data sovereignty and data residency is rising. Canadian organizations have a duty of care to protect Canadian PII to the highest possible standard and to keep it within our own borders.

Tokenization gives them a practical way to do both.

AI: enable it, don’t block it

The next step in the conversation was a natural one: if tokenization is the answer, how do we apply it to AI, and to LLMs in particular?

Every vendor in the data protection space is working on that question. The vast majority of employees are good people who occasionally make mistakes, and the market is building solutions that sit in front of tools like ChatGPT, Claude and Gemini to stop sensitive data from being pasted into a prompt.

What stood out in the room was how many attendees described their current AI protection strategy as blocking. That makes sense. Blocking is what security has always done, going back to DLP and firewall rules: if something looks bad, block it. Then come the false positives, and then come the workarounds.

I am a mother. If I tell my kids they cannot do something, they want to do it ten times more. Employees are no different. Tell them they cannot use ChatGPT or Claude and they will reach for a personal phone, a different LLM or another shadow AI tool.

The risk does not go away. It moves somewhere you cannot see it.

Traditional protection does not solve this either. If data goes into an LLM encrypted, masked or redacted, the model cannot do anything useful with it. Upload my redacted name and ask how to spell it, and the answer is worthless.

That is why DataStealth takes a different position: enable AI, as long as the data is secured.

We tokenize sensitive data on the wire, before it reaches the model, so employees get the full productivity and intelligence gains of real time queries without exposing the organization. It became clear in that room that this is an approach executives are not yet hearing from the market, and it has led to a number of follow up conversations since.

Where to start

The question we hear most often is simple: where do I even begin?

Everyone is somewhere on their data discovery and data protection journey. With quantum on the horizon and tokenization increasingly seen as the stronger alternative, here is how we approach it.

• Follow the 80/20 rule. Roughly 80 percent of an enterprise’s sensitive data lives in less than 20 percent of its systems: ERP, CRM and file shares, for example. You do not need to tokenize every database at rest and in motion by tomorrow. Rome wasn’t built in a day.
• Find your crown jewels. Identify where your most sensitive data truly lives, including shadow IT, data sprawl and AI tools, so you can prioritize and triage it as tier one protection.
• Don’t overlook legacy systems. Mainframes and older database environments are often where the scariest data sits in clear text. There is a perception that data on a 20 year old system is less sensitive. We challenge that. A name, a SIN or biometric identification is as sensitive today as it was 20 years ago.
• Assume you don’t know where it all is. We operate on the principle that no organization knows where all of its sensitive data lives. Finding it is the first exercise.

If you are researching the space, the analysts are a great place to start. Forrester and Gartner are both focused on data protection right now, and DataStealth is proud to be recognized by both. Peer recommendations matter too.

Thank you to IBM and the University of Ottawa

A big thank you to IBM for the work it is doing at the Cyber Range in partnership with the University of Ottawa.

The range is a real intersection of academia, industry and cybersecurity, and it shows in the details: many of the actors, prerecorded scenes and phone calls we experienced during the simulation were delivered by University of Ottawa students.

To my knowledge, it is the first immersive range of its kind in Canada. It made me want to go back to school.

Finding and protecting sensitive data is core to what IBM does for Canada’s largest enterprises. Doing it well means working with Canadian innovators who think differently, and DataStealth is one of them. - Chris Sicard, IBM

Let’s keep the conversation going

If you have open questions about tokenization, if you are hitting limits in your current tokenization strategy, or if you want a second set of eyes on a partial initiative that has or has not worked, let's talk. The same goes for any data type, compliance standard or legacy environment that is keeping you up at night.

AI has united the good guys: enterprises and security teams who all want to unlock the power of these tools without magnifying risk.

We are all in this together, and we're here to help.