Costume Jewelry: How Capital One Uses Tokenization to Protect Data

on YouTube ↗43m

" summary

Capital One builds a custom tokenization engine that preserves format, detokenizes on demand, and serves roughly 15k TPS / 160B ops per month while keeping high availability; teams adopt it in under a month (≈ one developer-month). Detection uses a homegrown scanner that scans S3 buckets and data lake exports (databases are dumped to S3), costs about $50k per PB, yields ~30% SSN false positives, and forces SLAs (10‑day triage, 120‑day remediation); free‑text, images and encrypted files remain the hardest gaps.

AI-written summary · about

" chapters (33)

1. 0:00Tokenization at Capital One
2. 1:05Tokenization crown jewel defense
3. 3:38Cloud-first strategy impact
4. 4:19Data types tokenized
5. 6:30Tokenization vs encryption
6. 8:19Tokenization in practice
7. 10:02Sensitive data inventory
8. 11:05Custom scanning tool
9. 13:18Scanning limits
10. 14:21S3 scanning upstream
11. 15:24Database scanning via S3
12. 16:07Scanning cleanup costs
13. 17:40Alert dispositioning SLAs
14. 21:01Protecting readable data
15. 23:07Custom tokenization engine
16. 24:11Tokenization success cases
17. 25:39Tokenization benchmarks
18. 26:22Enterprise app tokenization
19. 27:24Third-party limitations
20. 29:15Detection vs adoption program
21. 30:39Free text field challenges
22. 31:45Secure alert validation
23. 32:30Journey timeline status
24. 33:13Tokenization worth the effort?
25. 33:38Q&A: Commercial vs custom
26. 35:05Q&A: Scanning logs exposure
27. 36:11Q&A: Engine build effort
28. 36:52Q&A: PII remediation S3
29. 38:39Q&A: Stateful vs stateless
30. 39:43Q&A: App modernization
31. 40:24Q&A: Tokenization methods
32. 40:47Q&A: Referential integrity
33. 41:07Q&A: Tokens in unstructured

" related talks

• 40mA Case Study of the Capital One Data BreachAnchises Moraes, Nelson Novaes Neto · RSAC 2021
• 19mSecurityMichael Reitblat, Steve Shillingford, Sanjit Singh Dang · Collision 2018
• 16mAI-Powered Cloud Security: Lessons from Enterprise CRMNagasruthi Kattula · Conf42 Machine Learning 2025
• 49mToken It Up A Notch: Elevating Payment SecurityYadi Abdalhalim, Jovon Itwaru · Global AppSec Lisbon 2024
• 24mThe Great Balancing Act: Security, UX, and IdentityPierre Robert · apidays Paris 2021
• 48mSecuring the web with AICallum Whyte · NDC Oslo 2019
• 31mLeverage AI to Protect Your Data Assets... from AIDaniyar Mussakulov · QCon AI Boston 2026
• 30mProtecting Data While Maintaining Analyzability & Its Business Value: Is It FACT or FICTIONManuela Cianfrone, Alexander Ramm · Bitkom Privacy Conference 2021