I agree that "even if an institution nails down PCI compliance, they still have a long ways to go when contemplating keeping all financial data secure." I think it is important to think of PCI DSS as
minimum level and secure systems should go beyond PCI. We have seen in recent breaches that attackers moved on to more advanced attacks and to stealing PII data.

I agree that data masking can be effective to “minimize the number of openings in their systems though which sensitive data can be extracted.” Data tokenization can be even better in supporting most of our businesses processes.

Ulf Mattsson, CTO Protegrity