Capital One Software makes the case for AI-ready tokenization

AI tokenization has become essential for enterprises seeking to balance data security with innovation, enabling sensitive data to be used safely in AI workloads without compromising utility or compliance.

That requirement is reshaping how data security leaders think about their role in the organization. The old model — where security teams controlled access by restricting it — is increasingly at odds with the business velocity that AI demands, according to Vincent Goveas (pictured), director of product management at Capital One Software, a division of Capital One Financial Corp.

“Historically, security teams, what they had to do is block access to ensure safety, but … in this new environment that causes a massive conflict,” Goveas said. “For instance, your data science team or marketing team, they want real-time access to drive revenue and they have to wait, for instance, 30-plus days. The shift that we are seeing is companies want to move from perimeter defense to data-centric security.”

Goveas spoke with theCUBE’s Christophe Bertrand for an exclusive interview on theCUBE, SiliconANGLE Media’s livestreaming studio. They discussed AI tokenization, data-centric security strategies, and making sensitive data both safe and useful at scale.

AI tokenization: From perimeter defense to data-centric security

Capital One was among the first large enterprises to go all in on the public cloud — and discovered quickly that the market lacked tools capable of handling its scale across billions of monthly transactions. What it built internally eventually became Capital One Databolt, an enterprise tokenization solution now being commercialized to help other organizations accelerate their own cloud and AI journeys without compromising data control.

“There are four strategic pieces that make tokenization a much better choice in terms of making your data AI-ready,” Goveas said. “Tokenization replaces sensitive data with a non-sensitive placeholder … that preserves that format. For instance, an email address still looks like an email address. A ZIP code is still five digits. This means your existing applications and databases don’t break. That is huge.”

The advantages of AI tokenization extend beyond format preservation. Because tokenized data retains key structural properties, AI models can train on it while preserving much of the predictive fidelity — and a bad actor who breaches the system would be left with largely useless placeholders rather than clear-text sensitive data. To validate this in practice, Capital One Software partnered with PwC Research to test tokenization against masking and clear-text data across real-world AI use cases, including predicting patient heart risk from unstructured medical notes and forecasting patient care utilization from a structured health survey. In the structured data use case, masked data achieved only 50% predictive accuracy against a clear-text baseline — while tokenized data reached 99.7% accuracy, Goveas noted.

“What we realized is tokenization can lead to better AI predictions and, more importantly, have impactful business outcomes,” he said. “The research proves that when an AI model relies on sensitive fields like, for instance, age or ZIP code or transaction history in this case, to make a prediction, masking destroys that model. Tokenization is the only way to keep that model smart and the data safe.”

Operationalizing tokenization for AI requires a strategic shift in organizational mindset as much as a technology change. Goveas recommended enterprises tokenize data at ingestion — before it ever enters a data lake or warehouse — so that downstream pipelines are never polluted with clear-text personally identifiable information. Automated discovery and classification must run continuously because data volumes grow without pause, and self-service access architectures can eliminate the 30-plus-day ticket wait times that currently slow developers and data scientists. As Boston Consulting Group research shows, 75% of executives already rank AI as a top-three business priority — the data infrastructure behind those initiatives must keep pace.

“Don’t let your data strategy be defined by the past when your business strategy is focused on the future,” Goveas said. “By tokenizing, you separate the value of data from risk, allowing you to finally use 100% of your data’s power safely and securely, without compromising on your data’s utility.”

Here’s the complete video interview:

Photo: LinkedIn