A friend who runs a visa consultancy called me last spring, proud of a security upgrade: “We hash all the passport numbers now, so the lawyers say we’re fine.” Six months of paperwork later, the story had a different ending — because what he had bought was a myth, one of six that circulate through every industry that handles people’s documents, applications and itineraries. The discipline that would have caught this is DataSecOps, a name Ben Herzberg gave the practice in August 2021 while chief scientist at Satori Cyber — his description: security embedded into the agility with which data and its users change; a vendor’s coinage rather than a legal standard, but its habit of testing beliefs against documented behaviour is exactly what myths cannot survive. Here are the six, each with the story of what believing it actually costs.
Myth 1: “It’s hashed, so regulators are satisfied”
The friend’s story. A hash turns a passport number into gibberish — but the same passport number always produces the same gibberish, which means every dataset using that hash can be joined back together, and common values can simply be guessed and checked. That is pseudonymisation, not anonymity, and Europe’s regulators have said so with increasing precision. The Court of Justice ruled in September 2025 (EDPS v SRB, C-413/23 P) that pseudonymised data stops being personal data only for a recipient genuinely unable to re-identify it — while the copy held by whoever owns the key stays fully personal. The EDPB’s draft guidance from 2025 adds the caution that pseudonymisation on its own usually falls short as a protective measure. Cost of the myth: a compliance programme built on a join key.
Myth 2: “Masked data is de-identified data”
These words are used interchangeably in about half the meetings I sit in, and NIST has spent a whole publication — SP 800-188 — explaining why they must not be. Masking alters the view; de-identification is a release decision about the dataset itself, complete with measured residual risk. The classic measurement comes from researcher Latanya Sweeney: ZIP code plus gender plus date of birth sufficed to make 87 percent of Americans individually recognisable. Three boring fields. A birth date is the single most collected fact in travel — on every booking, every visa form, every loyalty profile — so treat any claim that a masked dataset is “safe to share” as the start of an analysis, never the end. Cost of the myth: a shared dataset that re-identifies its subjects the week it leaves the building.
Myth 3: “We encrypt everything, so DataSecOps is done”
Encryption at rest protects a stolen disk, full stop. The moment a query runs, the engine decrypts for whoever holds table access — so the question that decides real outcomes is who can read which row, not how the storage is sealed. Capital One learned this in public in 2019: roughly 100 million US individuals exposed through a misconfigured infrastructure path, and an $80 million fine from the OCC. The cryptography worked perfectly the whole time. Cost of the myth: eight figures and a headline, with the encryption vendor’s product functioning exactly as designed.
Myth 4: “The overlay tool sees everything”
Proxy platforms — Commvault’s Satori line, Immuta, Privacera — sit above the warehouses, converting a single rule corpus into the dialect of every connected engine. Useful, and genuinely money-saving for multi-engine estates. But a proxy enforces only what passes through it: direct connections, cross-account shares and cloned tables all step around the enforcement point unless the engines’ own native policies are switched on underneath. A consultancy I know bought an overlay, watched the dashboards go green, and never noticed the two analysts connecting straight to the warehouse from a BI tool. Cost of the myth: protection that stops precisely where the convenient paths begin.
Myth 5: “There’s a certification we can buy”
Vendors’ enthusiasm for the word makes people assume DataSecOps is a standard somebody ratified. It is not: no standards body uses the term, the practice has run for decades under the name data security governance, and Gartner’s 2025 market guide shelves the tooling under data security platforms. The practical consequence cuts both ways — you cannot certify against the label, so a vendor selling “compliance with DataSecOps” is selling air; and you cannot be fined for lacking it, because what the regulator grades is your actual governance, whatever you call it. Cost of the myth: procurement spent chasing a certificate that does not exist.
Myth 6: “Once the platform is live, the work is done”
The final myth is the quietest: that governance is a purchase rather than a loop. The documented failure mode is buying the platform before classifying the data — a tool configured over tables nobody has inventoried, producing beautiful rules about the wrong columns. And even a well-configured loop decays without maintenance: the quarterly review exists because access rots silently, with dormant grants accumulating until someone reads the list and revokes what went unused. Software with an expiry date in its grant list and a person who reads it is the difference. Cost of the myth: an expensive system that trends toward yesterday’s org chart.
The habits that replace the DataSecOps myths
Notice the shape of the corrections: measure residual risk instead of declaring safety, verify what leaves instead of trusting the perimeter, test the bypass paths instead of the demo path, and review access on a calendar instead of trusting purchases. None of it requires a specific product; all of it requires someone owning the questions. For technical teams, our walkthrough of DevSecOps mastery and secure delivery treats the code-side twin of that mindset, the data-side roles are mapped in industry-ready DataOps certifications, and the budgeting discipline that funds all of it sensibly is treated in FinOps training for governance and cost control. The term’s full dossier — origin, scope, and every document cited above — is kept current in the Ops Atlas DataSecOps entry.
- A deterministic hash is a join key, not anonymity — ask who holds the re-identification key.
- De-identification is a measured release decision (NIST SP 800-188), not a masking setting.
- Encryption protects disks; row and column policy protects queries. Audits grade the second.
- Proxies enforce what passes through them; clones, shares and direct connections bypass.
- No certification exists for the label — grade your governance, not your vocabulary.
- Platforms decay without reviews; the loop, not the licence, is the deliverable.
