Report > The Third Annual State of Data Compliance and Security Report: 2026 Edition

How Organizations Are Responding to Growing Data Risk

Back to top

Most Organizations Take a Portfolio Approach to Protecting Sensitive Data

We wanted to look at the techniques organizations are using today to understand how they’re addressing these challenges. What we found is that most organizations are combining multiple approaches, the most popular being:

Back to top

86%

Static data masking

60%

Dynamic data masking

51%

Synthetic data

Which of the following techniques does your organization use for protecting sensitive data in non-production environments? Select all that apply.

Each of these methods plays a different role.  

Static masking is widely used to protect full datasets in non-production. When done right, it should reflect realistic, yet compliant, data. 

Dynamic masking is often used in analytics and reporting, where there is a need to selectively mask and unmask data according to users’ roles. It is often native to modern data platforms.  

Synthetic data is used to generate new datasets that do not exist in production for software development and AI use cases. It is inherently PII-free.  

 

Back to top

Static Masking Remains the Most Trusted Foundation for Data Protection 

When we asked which methods meet specific needs, static data masking stood out as the strongest across all criteria.

  • Provides irreversible protection (65%) 
  • Meets SLAs to data consumers when protecting large-scale data sources (57%) 
  • Is cost efficient (64%) 
  • Prevents sensitive data breach or theft (62%) 
  • Provides data realism (60%) 
  • provides referential integrity within and across databases (63%) 
Back to top

What solution(s) meet your organization's needs if you require a data protection method that...

These findings reinforce static masking as a foundational and proven approach to achieve compliance and security. Organizations rely on static masking to protect sensitive data at scale, especially in non-production environments where full datasets are commonly used. 

Static Masking Is Preferred for Protecting Data Across Many Use Cases 

We also asked enterprise leaders which data protection approach they consider to be the most purpose-fit for protecting data for specific use cases, and again, they showed a strong preference for static data masking. 

45% selected static masking for software development and testing, 32% for data analytics workflows, and 30% for integration and unit testing. 

Static masking is the best option for maintaining data relationships across databases. That is why it works so well for testing (especially integration testing) and data analytics, whose results depend on the quality and referential integrity of data. 

Which Solution do you consider the most purpose-fit approach to protect data for the following use cases?

While static masking provides the strongest foundation for protecting real datasets, it is often complemented by synthetic data to address additional use cases. Combined, these approaches give teams compliant, high-quality data for full testing coverage and AI workflows.

 

Back to top

Synthetic Data Is Still Evolving as a Protection Method

While synthetic data is widely used, based on the solutions available at the time of the survey, fewer respondents identified it as sufficient for certain core data protection requirements compared to more established methods.

We see this as a reflection of where the market is today. Synthetic data is still a maturing category, and the available solutions at the time of the survey may not have fully met enterprise leaders’ expectations for data protection.  

Additionally, many organizations are using synthetic data mainly to support development speed rather than as a primary compliance control.

As the market evolves and newer, more advanced solutions become available, we expect these perceptions to continue to shift. For now, most organizations view synthetic data as part of a broader approach. It complements other, more established protection methods.

 

Back to top

Beyond Security, Scalability and Usability Shape Solution Choice

Unsurprisingly, 43% of respondents said security is the most important factor when evaluating a data protection solution.  

But beyond this obvious most important criterion, the next most important ones included:

Back to top

24%

Scale and speed

23%

Ease of use and user experience

These criteria determine whether a solution can be used consistently and easily across large, complex environments without impacting speed of innovation.

A solution must protect data effectively, but it must also keep up with the pace of development and analytics — including increasingly automated, agentic workflows.

What are the most important criteria you use to evaluate a data protection solution for your organization? Select up to two.

"As data refresh cycles accelerate and data consumption explodes, protection must move at the same speed. Because security that only works on paper isn’t security, it’s inertia."

Pritam Mahaptra | Senior Vice President | Truist

Speed and Scale Require Better Data Delivery

Security alone isn’t enough. Teams need fast, reliable access to high-quality data to keep up with modern development and AI demands. Our 2026 Test Data Management Report for AI-Ready Enterprises reveals where workflows are breaking down, what enterprises are doing about it, and how to lay out a roadmap for agentic development. 

Access the Test Data Management Findings
Back to top

Enterprises Must Protect Data Across Both Legacy and Modern Systems 

Organizations are also managing an increasingly diverse set of data sources. In non-production environments, data must be protected across both traditional systems and modern platforms. 

The most common sources organizations wish to mask are no surprise: Oracle (47%), Microsoft SQL Server (42%), Microsoft Azure data sources (31%), and SAP (28%).  

Analytics data platforms are also a priority, including Databricks (25%) and Snowflake (18%), indicating a need to protect sensitive data in other non-production environments like AI, ML and analytics. 

This data reflects the reality of enterprise environments today. Data is not confined to a single system or architecture. It spans on-premises systems, cloud platforms, and analytics environments, all of which must be protected consistently.  

This underlines the need for solutions that enable organizations to apply a single compliance policy across multiple data systems.  

Back to top

What data sources does your organization need to mask when used in non-production environments? Select all that apply.

Back to top

A Complex Enterprise Landscape Requires Flexible, Scalable Protection Strategies 

In our opinion, these findings point to a complex landscape.  

Organizations combine multiple methods to meet different needs across environments and use cases. 

In practice, this includes: 

  • Using static masking for large-scale non-production protection. 
  • Applying dynamic masking in some analytics and access control scenarios. 
  • Leveraging synthetic data for testing and AI use cases. 

This portfolio approach reflects the need to apply the right protection method to the right use case, based on specific data, performance, and requirements. It highlights the advantage of unified platforms that bring multiple approaches together — along with data delivery, governance, and centralized control — to apply consistent protection while supporting speed and scale. 

 

[NEXT] Find Key Takeaways from This Report

Back to top