The Names Are Silent. The Data Is Speaking.

Imagine removing every name from a file relating to the sale of a company. The company becomes ‘A,’ the buyer ‘B,’ and the executives individual letters. Phone numbers, email addresses, and identity numbers are removed.

Yet this sentence remains in the file:

‘Current cash covers six weeks of payments. If closing takes place before the loan matures, the seller may consider a lower price.’

You successfully concealed the names. But you left the seller’s weakest negotiating point untouched.

When we discuss enterprise AI security solely in terms of masking personal data, we can miss this detail. A company’s most valuable secret can remain valuable even when its owner is unknown. For someone who knows which negotiation the file concerns, ‘Company A’ is clear enough.

Deleting a name does not erase the economic value of the information.

The maximum discount that could be offered to a customer, the location of an unannounced investment, dependence on a critical supplier, the final acceptable condition in a bank negotiation… None has to fit a recognizable pattern like a phone number. Yet in the wrong hands, each can narrow the company’s room to maneuver.

And we use AI precisely so it can make these connections. We want it to extract meaning from long documents, combine scattered information, and notice relationships we have missed. Then, once we hide the names in the text we give it, we assume it cannot connect the remaining clues.

There is a serious contradiction to resolve here.

Research presented by ETH Zurich researchers at ICLR 2024 showed that language models could infer personal attributes such as location and income from people’s online posts. Common anonymization methods tested in the study did not provide sufficient protection against those inferences. The research did not examine corporate secrets; its finding was more fundamental: information not explicitly stated in a text can still be learned from it.

Data masking is therefore a necessary and valuable layer. But its protective scope must be described accurately. Presidio’s own documentation explicitly says that automated detection does not guarantee finding all sensitive information and that additional safeguards are needed.

Watching names, phone numbers, and account numbers disappear from the screen during a product demonstration can be impressive. I would want to see something else too: what can someone reading the cleaned text still learn?

Because ‘How many fields did we hide?’ and ‘What did we protect?’ do not always answer the same question.

On the defensive side, the same team also proposes a solution.

ETH Zurich researchers developed a framework that tests text anonymized by one model against another model’s attempts to infer personal information. The approach outperforms the commercial anonymization tools compared in both privacy and text utility. It does not guarantee security for every document, but it offers a meaningful measure: test not only the words removed, but also the inferences still possible.

For companies, removing everything from a text cannot be the answer either. A system evaluating cash flow may need to know collection terms, amounts, and customer concentration. Remove them, and you may end up with an application that looks safe but is useless.

The real design question is: which information is necessary for this decision, and which detail is being exposed unnecessarily?

The answer does not lie with the software team alone. Understanding the commercial importance of information requires knowledge of the contract, financing, operations, and negotiating conditions. Domain expertise contributes to AI design long before correcting errors in its output.

The next boundary of data security is even more interesting: a document given to the system may contain no secrets at all, yet still direct the system to do the wrong thing.

For example, suppose a file read by an assistant comparing proposals contains instructions to change the evaluation criteria. Even if the personal-data filter removes every name flawlessly, those instructions may remain.

The UK’s National Cyber Security Centre discusses this kind of prompt injection in its December 2025 advisory. Untrusted content can be processed by the model as instructions. The Centre therefore emphasizes controls that restrict the system’s actions independently of the model.

This brings us to a familiar management issue: delegation of authority.

When we hire a highly capable finance professional, we do not give them access to every account and unlimited payment authority on their first day. We define what information they can see, what they can prepare, and who approves which transactions. Ability alone is not grounds for authorization.

AI systems require the same management discipline.

Being able to understand a contract does not grant authority to amend it. Being able to recommend a payment does not grant authority to execute it.

NIST’s AI Agent Standards Initiative, launched in February 2026, includes research on agent security and identity. The parallel NCCoE work focuses on authorizing these systems’ access and actions. The direction is clear: identity, access, and authority boundaries must be deliberately designed for AI that can take action.

I believe this is where the real competitive opportunity lies.

It is difficult to give a system with unclear boundaries access to a company’s valuable data. AI may then remain an assistant that writes generic text, summarizes meetings, and prepares presentations. But to solve the company’s real problems, it needs sensitive data, context, and sometimes authority to act.

Security is therefore a design issue that directly affects return on investment. Clearly defining which data can be used for which purpose, who can see it, and which actions it may lead to makes more valuable use cases possible.

At the next AI demonstration, let us look beyond how well the system answers. Let us also ask which pieces of information it can combine, who can see its answer, and what it can do next.

Because a company’s secret may lie not in the deleted name, but in what the remaining sentence reveals. And by the time the ‘send’ button is pressed, authority may already have been delegated.