FDD Urges NIST, NSA to Evaluate New Anti-Ransomwa...

Executive Summary

The Foundation for Defense of Democracies (FDD), a Washington D.C.-based think tank, has publicly called on the National Institute of Standards and Technology (NIST) and the National Security Agency (NSA) to formally evaluate an emerging data protection technology: vaultless, keyless pseudonymization. In a statement on October 30, 2026, the FDD argued that traditional encryption, while essential, leaves a critical gap. Data is vulnerable when decrypted for processing, creating opportunities for theft. The proposed technology aims to mitigate this by replacing raw sensitive data with pseudonymized tokens that have no intrinsic value if stolen, thus neutralizing the impact of data breaches and ransomware attacks.

Regulatory Details

The FDD's proposal is not a new regulation but a call for U.S. standards bodies (NIST and NSA) to vet and potentially standardize a new approach to data protection. The core idea is to shift the focus from solely preventing intrusions to also minimizing the damage when intrusions succeed.

Problem Addressed: Conventional encryption protects data at rest and in transit, but not in use. When data is decrypted for an application, AI model, or third-party vendor to use, it becomes vulnerable. Ransomware and data theft attacks often target data in this exposed state.
Proposed Solution: 'Vaultless, keyless pseudonymization' replaces sensitive data elements with irreversible tokens. The original data is never stored in a central vault that could be compromised. Authorized applications can restore the data on-demand through a secure process, but the stolen tokens themselves are useless to an attacker.

Affected Organizations

This initiative would primarily affect:

U.S. Government Agencies: NIST and the NSA would be responsible for the evaluation.
Technology Vendors: Companies that offer tokenization, pseudonymization, and other data protection solutions would be subject to increased scrutiny and would need to align with any new standards.
All Industries: If adopted as a standard or best practice, organizations across all sectors (especially healthcare, finance, and critical infrastructure) would be encouraged or required to adopt such technologies to protect sensitive data.

Compliance Requirements

If NIST and the NSA were to develop a standard based on this technology, future compliance requirements could include:

Data De-valuation: Mandating that sensitive data be pseudonymized or tokenized before being processed by applications, particularly in cloud and multi-vendor environments.
Proof of Irreversibility: Requiring vendors to provide independent verification that their tokenization process cannot be reversed by an unauthorized party.
Downstream Data Revocation: Demonstrating the ability to programmatically revoke access to data, even after it has been shared with third parties.

Impact Assessment

The FDD argues that this approach could fundamentally change the economics of cybercrime. If stolen data is worthless, the incentive for data theft and double-extortion ransomware diminishes. For businesses, this could mean:

Reduced Breach Impact: A breach would still be a security incident, but it would not necessarily be a catastrophic data loss event.
Safer Data Sharing: Organizations could more safely share data with partners and leverage cloud-based AI/ML services without exposing raw sensitive information.
Increased Vendor Scrutiny: A push for greater transparency from technology vendors about how they handle customer data.

Compliance Guidance

While no formal guidance exists yet, the FDD's push suggests organizations should begin thinking about their data protection strategies beyond encryption.

Data Discovery and Classification: Identify where your most sensitive data resides and how it is used.
Evaluate Data-in-Use Protection: Assess the risk to data when it is actively being processed. Are there opportunities to use tokenization or pseudonymization instead of live data?
Vendor Due Diligence: When procuring new software or cloud services, ask detailed questions about how the vendor protects data-in-use. Does raw data ever enter their environment? Can they prove it?
Monitor NIST/NSA Publications: Keep an eye on any future guidance or frameworks released by these agencies regarding advanced data protection techniques.

In line with the FDD's recommendation, organizations should proactively explore and implement Data Pseudonymization to protect sensitive data-in-use. This technique replaces sensitive data fields with structurally equivalent but non-sensitive placeholders (tokens). For example, a real credit card number could be replaced with a token that passes validation checks but has no monetary value. The key is to adopt a 'vaultless' approach where the original data is not stored in a central, high-value target. Instead, it is either discarded or the re-identification capability is tightly controlled and segregated. This drastically reduces the impact of a data breach; if attackers steal the pseudonymized dataset, they have stolen nothing of value. This is particularly relevant for development/test environments, analytics platforms, and when sharing data with third parties.

FDD Pushes for Evaluation of Pseudonymization vs. Ransomware