In this interview from RSAC 2026, Prashant Prahlad, senior vice president of product at Capital One Software, joins theCUBE's Dave Vellante to discuss how format-preserving tokenization is unlocking proprietary enterprise data for AI and analytics without compromising security. Prahlad explains how Capital One Software — a division born roughly five years ago to externalize innovations built inside Capital One — addresses the false choice between protecting sensitive data and putting it to work. By replacing PII, PCI and HIPAA information with format-preserving tokens, downstream applications can run analytics and power AI workloads without triggering the compliance obligations that traditionally kept that data locked away.
The conversation also explores a new capability announced at RSAC: tokenization for unstructured data, which represents roughly 70% of the proprietary information enterprises need to fuel differentiated AI. Prahlad highlights how advances in LLMs now enable cost-effective scanning and classification of PDFs, emails and transcripts that were previously too expensive to process at scale. He also unpacks the company's vaultless architecture, which eliminates the burden of key management, and its patented post-quantum-safe algorithms. Beyond security, Prahlad outlines Capital One Software's broader platform vision — stitching together cost optimization, data lineage, classification and tokenization into a unified data management layer — while building an ecosystem of partners including Sync Software and Boomi to extend its reach into regulated industries like healthcare. From modernizing dark data to enabling safe third-party sharing, Prahlad provides a roadmap for how enterprises can turn their most sensitive information into a competitive advantage.
Forgot Password
Almost there!
We just sent you a verification email. Please verify your account to gain access to
RSAC 2026 Conference. If you don’t think you received an email check your
spam folder.
In order to sign in, enter the email address you used to registered for the event. Once completed, you will receive an email with a verification link. Open the link to automatically sign into the site.
Register for RSAC 2026 Conference
Please fill out the information below. You will receive an email with a verification link confirming your registration. Click the link to automatically sign into the site.
You’re almost there!
We just sent you a verification email. Please click the verification button in the email. Once your email address is verified, you will have full access to all event content for RSAC 2026 Conference.
I want my badge and interests to be visible to all attendees.
Checking this box will display your presense on the attendees list, view your profile and allow other attendees to contact you via 1-1 chat. Read the Privacy Policy. At any time, you can choose to disable this preference.
Select your Interests!
add
Upload your photo
Uploading..
OR
Connect via Twitter
Connect via Linkedin
EDIT PASSWORD
Share
Forgot Password
Almost there!
We just sent you a verification email. Please verify your account to gain access to
RSAC 2026 Conference. If you don’t think you received an email check your
spam folder.
In order to sign in, enter the email address you used to registered for the event. Once completed, you will receive an email with a verification link. Open the link to automatically sign into the site.
Sign in to gain access to RSAC 2026 Conference
Please sign in with LinkedIn to continue to RSAC 2026 Conference. Signing in with LinkedIn ensures a professional environment.
Prashant Prahlad of Capital One Software, senior vice president and head of product, discusses data-centric security tokenization and platform strategy at RSAC 2026. Prahlad outlines Capital One Software's evolution from in-house tools to commercial products such as Slingshot and Databolt. They bring deep experience in cloud-native architecture data management and security and describe tokenization for structured and unstructured data dark data discovery cost-effective scanning and guidance for customers modernizing data stacks for enterprise artificial intel...Read more
exploreKeep Exploring
What is Capital One Software, and what is its purpose?add
How do you view proprietary data as a competitive advantage for enterprises using AI, and how do you help customers safely unlock and use that data for analytics?add
Why has it historically been so difficult for enterprises to find, scan, and tokenize unstructured data, and what catalyzed your recent ability to do this—was generative AI the enabling factor?add
What opportunities and risks does “dark data” present, and how can technologies like tokenization, format‑preserving encryption and open table formats help unlock that data and mitigate the associated risks?add
How should an organization decide whether to build its own services or adopt equivalent services from a cloud provider, and how can it identify durable areas of differentiation to focus on?add
What is your platform vision, and is your intent for the portfolio of tools (which began with a cost-optimization tool) to become a full data platform?add
>> We're back at Moscone West, RSAC 2026. You're watching theCUBE's coverage. I'm Dave Vellante. Wall-to-wall coverage, Monday, Tuesday, Wednesday, Thursday, four days. Myself, Christophe Bertrand, Jon Oltsik is also here. He's out getting all the notes on the show floor. Prashant Prahlad is here as the senior vice president and head of product at Capital One Software. You may not have heard of Capital One Software, you may have. Prashant, welcome to theCUBE. Thanks for coming on.
Prashant Prahlad
>> Good to be here, Dave.
Dave Vellante
>> I've been watching you guys sort of build innovation internally, kind of point it externally, kind of the AWS model. But give us the update. What is Capital One Software for those who don't know?
Prashant Prahlad
>> Yeah, so Capital One Software is a separate line of business from Capital One that many people may know is the bank. So Capital One Software was created a little under five years ago to actually externalize some of the innovations we built in-house within Capital One. So a lot of people don't know, but Capital One is almost a tech company inside that happens to be a bank rather than a bank that happens to technology. So we were first to the cloud, first to bring data into credit cards back when the company started. So tech is a very important part of what the company does. So a lot of the products that have been built in-house, we're starting to see customers like ourselves ask for it. So we're starting to externalize that with Capital One Software.
Dave Vellante
>> Wasn't one of your early products, and correct me if I'm wrong, it was like a FinOps, I would call it, and you guys were using that internally to optimize? And then of course, 2022 came around and everybody wanted to optimize their cloud spend. Is that what got you started and how has that been going since?
Prashant Prahlad
>> Yeah, so the first product we put out was the warehousing optimization specifically with Snowflake. And that was adopted really well by customers. It helped them optimize how they use warehousing solutions, especially as data became such a big part of what a lot of industries do. So that product is called Slingshot. That's the name of the product. And it has been growing well. We introduced support for other warehousing providers, started doing more than data management, more than warehouse optimization, including data management and so on. At RSA last year, we launched another product based on the success of the first one called Databolt that helps you secure your data and make it available for downstream analytics. Happy to talk more about that.
Dave Vellante
>> Well, okay. So I mean, everybody likes to talk about GPUs and models. We do too, but the real bottleneck in the enterprise is data. And so, maybe we could start there. Proprietary data, it's the lifeblood of an organization, it's the ultimate differentiator for a company. That's what everybody wants to leverage. So what are your thoughts on that and how do you guys help customers take advantage of it?
Prashant Prahlad
>> I mean, data is the new currency with AI, right? I mean, it's logically the thing that... I guess before we had the internet, information was siloed in many places and you have information asymmetry, but internet made that okay. I think that's what's going to happen with intelligence, right? You're going to have common intelligence everywhere that you can get from the internet. But what differentiates a business long-term is the things that are proprietary that make your models and your AI much smarter than your competitors, because common knowledge is going to be everywhere. So that proprietary data actually exists and companies have built that over several decades that are sitting somewhere because somebody is afraid that this data has sensitive information or this data is not being utilized correctly, or the fear of AI using this data to do something malicious. So for us, that's the opportunity. That's the key unlock we had with Databolt, is how do we enable companies of the future when everything is going to change in the next five years, but the things that are remaining constant is data is going to be the differentiator? And how do we unlock that for our customers? That's really what was behind some of our products.
Dave Vellante
>> Of course, we were at GTC last week, so we have this AI factory recency bias on our brains with the Kool-Aid injection that we got there.
Prashant Prahlad
>> We all have.
Dave Vellante
>> But of course, it's exciting. But you basically have power and you have compute and you have data goes into the AI factory and intelligence comes out. But as you sort of alluded to, this kind of general intelligence that's trained on the internet, it's the proprietary data, that sensitive data that gets you competitive advantage. So what has to happen for enterprises to be able to take advantage of that and what role do you play?
Prashant Prahlad
>> Yeah. I mean, first of all, there's a false choice presented when it comes to proprietary information or sensitive data, that either you protect it and create a data silo and make sure that only certain people have access to it, or you just allow AI to run loose with it, right? There's two extreme versions of that. What we've seen is for the use cases that most of our customers are starting to sort of utilize today, you actually don't need to know the specifics of the sensitive information, you just need to have the data to do analytics. So for example, Dave, you travel a lot. If you're flying to different parts of the country or the world and you're staying at different locations, my application may just need to know that this entity is doing that. I don't need to know that it's Dave. I don't need to know your address. I don't need to know your social security number. So what we've been doing at Capital One for a while is deplacing any kind of sensitive information about an individual PII, PCI. We have customers in healthcare who are replacing HIPAA information with this. We're replacing them with format-preserving tokens. It's called a tokenization. And it's a form of encryption that, we can get into the technicalities of it, but it's safe. So what that allows you to do is your downstream applications can do analytics. It can do all sorts of things it would do, because there's a format-preserving token there without sort of exposing your private information to those applications. So think about the unlock there, right? Now, I'm sure we're all familiar with payment card industries, PCI. Now, PCI, credit card numbers, for example, if an application processes your credit card number, there's a whole PCI compliance that it's subject to, and everything that that application touches must be PCI-compliant. So you start sort of going down the path of making sure everything that that application uses then uses PCI compliance. So it's a chain that's pretty rigorous and well-thought through. But if I remove the personal information from that data, the application downstream, as long as it's not mathematically reversible, doesn't have to be subject to the same compliance regimes that it did before.
Dave Vellante
>> Ah, so to the extent that you can make it safe, then that just expands the TAM. And when you say safe, is it... It's a little tangent, but is this "post-quantum safe"?
Prashant Prahlad
>> Actually, yeah. We actually have post-quantum tests on our algorithms. It's patented, it's post-quantum safe. Yes. It's a very common worry we have.
Dave Vellante
>> Yeah. We're starting to hear a little bit more about quantum at these events. It's not a dominant theme, but it will be at some point.
Prashant Prahlad
>> Yeah, we just have to be one step ahead.
Dave Vellante
>> Yes, right.
Prashant Prahlad
>> Or many steps ahead.
Dave Vellante
>> I mean, you're taking a sort of a data-centric security approach. Walk us through your portfolio, your product portfolio. If you could give us a little direction in terms of where you're trying to innovate, but lay out the portfolio for us today and anything new that's at RSAC.
Prashant Prahlad
>> Yeah. So as we alluded to, our first product in our portfolio was this product called Slingshot that allows you to optimize cost for warehousing and infrastructure as well. Our second product is Databolt, which is a tokenization product that allows you to tokenize sensitive information and allow third-party sharing, downstream use cases. We're seeing a lot of traction from regulated industries, financial services, of course, and healthcare and so on. And what we've been building since then is a platform that brings security, optimization, everything related to data management together. And this data management has many sort of features that we've been building out. We actually announced at RSA the ability to bring tokenization to unstructured data. So traditionally, when you have warehousing solutions and sort of big data, you're looking at a structured data warehouse that you're tokenizing social security numbers and so on. But 70% of the actual data that AI systems will benefit from that's proprietary happens to live in PDF files, emails, and transcripts and all these other things. So we've found an ability to scan, classify, and tokenize that information that allows downstream AI applications to start using them to become smarter.
Dave Vellante
>> And what was the catalyst for that? Was it a generative AI that enabled that? Why has it been so difficult to get your arms around enterprises, get their arms around unstructured data? Why is that such a hard problem historically and what was the sort of catalyst that enabled you to begin to solve this problem?
Prashant Prahlad
>> Yeah. I think one of the challenges is this data has been locked in, in different locations, right? I think finding and scanning that data in a cost-effective manner has always been sort of tough. Because think about it, you could scan a petabyte of data and find a few megabytes of useful information. So you've just wasted your capital on scanning something that was not useful. So intelligent ways of scanning that data are now possible that were not possible previously thanks to the LLMs advancements. So cost-effective scanning, sampling, statistical sampling, all of these things are one sort of aspect of it. And what we're also seeing is that internally, both Capital One and sort of the customers of these products are asking us, "How do I bring in sort of the thing that will help me differentiate the most? I don't want to do what you can get off the internet with standard foundational models. I want to be able to use retrieval augmented generation, RAG use cases or prompt engineering to actually go bring proprietary information. So I need to unlock that." Right now it's for experimentation, so I don't see this as a, "Hey, I'm not going to production tomorrow." But what's very obvious is without this data, you are not going to differentiate long term and that pull has been driving us to get there.
Dave Vellante
>> What about dark data? You were talking earlier about this, this could be a massive unlock. There's all this dark data. What's that opportunity? What are the risks associated with that? Presumably your products are helping to mitigate those risks.
Prashant Prahlad
>> Yeah, one thing we found is customers who have protected data, dark data, they tend to have different set of data stacks to support them. So you have a different type of tooling, you have a whole other sort of stack that is different from anything you use sort of traditionally. And with something like tokenization or format-preserving encryption even, you're basically saying, "Hey, I don't need to have these data silos and I don't need to have these different tools for different types of data. I can use the same tooling." It makes procurement easier. It's very economical. The key is it has to obviously be safe to do so. So for us, that's the unlock that we've been working in the dark data.
Dave Vellante
>> Do open table formats play in that?
Prashant Prahlad
>> To a certain extent, we support different open table formats, yes. They're part of what we do, but at the end of the day, we're largely driven by what our customers are asking for. And what we found is many of these customers, we are discovering with them. So it's deep engagements with them to figure out exactly where the data is, what we can do with them. And the products happen to be... One of the advantages that we find, is because there's so much data we discover, customers don't want to be in the business of managing keys and rotating those keys to actually make those sensitive data be available. They prefer that you use a vaultless technology, which is what tokenization is. There is no vault that has keys that you have to keep managing. We rotate the keys for you. So that problem is just taken away and that has helped customers bring different data silos together for various analytics use cases.
Dave Vellante
>> Well, I mean it's quite obvious that one of the main problems that you're addressing is there has always been this yin and yang between protecting data and then allowing access to that data. The more access, the more risky. And so, essentially you're removing that barrier. And how are your customers... There must be a lot of ways that they're monetizing this.
Prashant Prahlad
>> Yeah. There's two aspects I've heard of this. One is called modernization of your data. And the second part, subsequent part is monetization of the modern data.
Dave Vellante
>> Yeah, yeah, okay.
Prashant Prahlad
>> So customers are on different parts of that journey. And when I say modernization, just making... There are various data management tools that allow data to be presented in a way that downstream applications can use it. Now, at Capital One, we've been doing it for 10 years now, and it's very self-service. So if you were an application team, you would go and say, "What are the data products I have to use? This is all data that has been presented to me. It's self-service. I can use it." So if you're an app team, you can get up and running superfast. And I've seen many customers in that category. They've modernized their data stack, they have a data management portal that allows teams to self-service and use clean data. Now, not all customers are in that category. Customers are still in the process of moving data that exists in mainframes and things that are unbroken, so why move that data to the cloud? Now, we are helping those customers move data into modern data warehouses. And then from that point on, when you start modernized, so to speak, that data, that's when you start doing chargeback for data that's being used, and then you start monetizing it, perhaps making it available externally though. I haven't seen that happen yet, but that could be in the future.
Dave Vellante
>> So I want to put a finer point on that. You mentioned the mainframes. Are you seeing customers now say, "Hey, I'm actually going to move more data into the cloud."? I mean, obviously the cloud continues to grow. I mean, it's like everything is growing these days, but I talked to a lot of customers who say, "I want to bring the AI to the data." I guess it goes both ways, but are you seeing any predominant trend? Or...
Prashant Prahlad
>> Well, it works. It goes both ways. So there are four key use cases we're seeing customers sort of bucket into. One of them is, "I would like to modernize my data and move it to the rest of my cloud infrastructure, right?" That could be in a data warehousing solution like Snowflake or Databricks. It could be AWS or one of the big hyperscalers. So customers are in the process of doing that. They've done most of the heavy lifting, but they still have these big tranches of data that are sitting in tools that they haven't yet moved. So we're seeing that as sort of one key use case. So the second one is, "I want to do analytics with that data." So the example I was mentioning, if you are an application team, you want to be able to use as much data as you can get for your application to perform well without being subject to all kinds of regulatory issues. So you basically say, "I'm going to do downstream analytics and AI with that application, with that data." So that's the second use case they're trying to unlock. The third one is data sharing, right? Now, it's not uncommon that, as if I was a company and I had multiple vendors, there is some data sharing happening. And if you look at breaches of the past, I'm sure you'll see that most of it happens when the vendor is not subject to the same set of regulations that the owner of the data is, and somewhere in transit this data gets misplaced or gets lost or gets exploited. Third-party data sharing and internal data sharing has become a very, very interesting use case for us and we're seeing a lot of customers move around that. But to answer your original question, migration to the cloud is still a big deal. And what we're also seeing is some customers have said, "Hey, I'm going to keep data where it is, because of gravity reasons, and move my applications closer to that data." Because they haven't either got on the cloud journey or they've said they've made a decision to maintain data centers on-premise and they're building specific storage solutions on-premise. And we've seen customers do that, especially larger institutions.
Dave Vellante
>> Well, you remember, I mean when the cloud first came out, it was so alluring, because it was just so inexpensive relative to sort of the umbrella that I traditional IT set. Things have balanced out somewhat, it has only taken 20 years.
Prashant Prahlad
>> I mean, this is a cycle, right? The pendulum swings one way and then comes back the other way, so it's a matter of time.
Dave Vellante
>> And you don't care where the data is? You can protect it at rest, in motion, at use, irrespective of the physical location? Is that right?
Prashant Prahlad
>> Yeah. I mean, so customers have taken us there. So the original question, obviously we have a control plane that lives as a SaaS, but the data plane where the data actually gets processed is with the customer, so we don't get into that. Now, some customers have said, "Hey, I want everything to be on-premises, because I have so much data that I don't want any part of it to be outside of my environment." So we have a hosted, self-hosted control plane solution for those customers where they manage everything on their own. It's the traditional... I'm dating myself, but my first time I shipped software, I got a CD of the software I shipped on my desk, right?
Dave Vellante
>> I had a floppy, so...
Prashant Prahlad
>> I used five and a quarter. Not even three and a half, five and a quarter. So it is that. We are actually shipping a golden image for those customers who want to actually deploy it on-premise. Of course, it's a Kubernetes environment and it's a cluster and everything, but it's the same thing.
Dave Vellante
>> Those are the days when the marginal economics of software went down to the price of a CD-ROM.
Prashant Prahlad
>> And you have a bug in your software and you burn these golden images on CDs and you have to spend a lot of money re-burning them. I've done that.
Dave Vellante
>> So that's interesting. So your customers pulled you that directly. Because Capital One, very advanced early on getting into the cloud, you guys leaned in and obviously your business benefited from that. What are some of the gotchas and the learnings that organizations should be aware of, kind of the dos and don'ts?
Prashant Prahlad
>> Yeah. I mean, look, I've seen this from the other side. I used to be at AWS when I saw Capital One adopting the cloud early on. Actually, they were one of my customers of a product I launched and I was always wondering, how are they at this leading edge of adopting cloud? It's a bank, right? You expect them to be a little bit more conservative and take their time. I think what Capital One has done, which amazes me genuinely, is they're a completely service-oriented architecture, right? So different what Amazon would call two pizza teams exist to run a service, the same team that builds the software, ships the software. So from that perspective, it has been great. Now, the cloud has been evolving at a pretty rapid rate in the last decade. So what would happen is Capital wanted to adopt early services and then Amazon would have the same services. So there was sort of this, "Should we build the thing we used or should we just adopt the service that Amazon is doing and then build something else?" And that decision point can sometimes be tricky for customers. So that's the gotcha. What I've seen happen at Capital One is that over time we've gotten better at saying, "Hey, this is undifferentiated heavy lifting. We don't have to do it. We'd just much rather buy the service from a cloud provider and then focus our efforts on adding value somewhere else." And that's an easy to say, hard to do decision.
Dave Vellante
>> Yeah, because you don't know at the time if it's a differentiator, it may feel that way in the market. Especially now, the market changes every three months. And what you thought was innovation, some LLM vendor is going to be doing it. And so, it is a tricky proposition. So how do you filter that?
Prashant Prahlad
>> Yeah. I mean, in sort of first principles way of thinking about it, is when everything around you is changing and even the rate of change is accelerating, you have to bet on things that you know will remain constant. You have to find your durable differentiation. That's why we are in the data business. Data management, data cataloging, lineage, sensitive data tokenization, this is the fuel that we know will need to power everything that's going to change ahead of us. So if you apply sort of that foundational thinking of, you want to be the shovel in the gold rush, if you will, right? So that's kind of the mindset we've been applying in this. But I mean, at some point you have to sort of go higher up stack and we obviously want to do that based on what will differentiate us as a business.
Dave Vellante
>> Well, and Amazon actually taught, you mentioned two pizza teams, there's no compression algorithm for experience. I mean, there's so many sayings. I mean, the leadership principles, the customer obsession, all of those were sort of taught to the industry. The industry has adopted them now and now we're learning a new set of principles driven by AI. Do you think that this sort of new data foundation that we've been talking about essentially kind of becomes zero trust, that it becomes fundamental to security teams?
Prashant Prahlad
>> If I were to wager a bet, I think it will be. I would put my money on it, because there's just so much change around us right now that information, intelligence asymmetry is no longer a thing. Everyone will have the same level of intelligence. Everyone will have the same level of information. So data is going to be where I think every company is going to differentiate based on that.
Dave Vellante
>> 12 months from now, what will you look back and say, "Okay, we were successful from a product roadmap or adoption."? How are you going to measure that?
Prashant Prahlad
>> Well, I want customers to be coming here and being sort of raving fans of what we built. That would be the true testament. Leading up to that, I want to help customers unlock value. At the end of the day, there's just a lot of innovation that everyone wants to do, but they're not enabled to do it in these companies that we're working with. So we're in the enabling business. So I would feel fantastic if my products actually helped customers take whatever they're building, their applications, their AI initiatives to that next level of production. I think to me, that would be great. And then we're going to do it as sort of the data plumbers. We're going to bring data to those customers. We're going to make it available for their applications to use. We're going to make sure that it's safe for them to share it with third-parties, so on and so forth.
Dave Vellante
>> That's always exciting for somebody who builds products, to see them adopted. There was an article, I don't know which publication had it, said, "The big thing in San Francisco is everybody is a builder. And what is that?" But we know what builders look like, and so we've been watching them for years. So yeah, it's that adoption metric that gets you excited.
Prashant Prahlad
>> And you want to be a tool builder, right? At the end of the day, human beings have become more productive because we have tools that make us more productive. They give you 10x productivity. AI is going to be a tool to make the next generation of builders. To make the AI better, we are in the business of building tools that make the AI better, so we're downstream from that.
Dave Vellante
>> Talk to me about your platform vision, however, right? I mean, as a head of product at Capital One, you're building out a platform that started with this cost optimization tool, right? But now you're building a portfolio. Do you see that as becoming a platform? Is that your objective?
Prashant Prahlad
>> 100%. I mean, platforms, the term can mean many different things to different people.
Dave Vellante
>> Okay.
Prashant Prahlad
>> At the end of the day, our job is to empower innovation by unleashing data, right? So that mission means we have to do whatever customers need to innovate safely using their data. And at the data management platform, the boxes you would draw to make it a platform would include things like lineage and scanning and classification and cost optimization and tokenization and et cetera, et cetera. Now, you don't want to boil the ocean, but we certainly want to make sure that we're building this platform in a very deliberate way that is still solving a very specific customer need.
Dave Vellante
>> Really appreciate you coming on theCUBE.
Prashant Prahlad
>> Yeah. We're just getting started.
Dave Vellante
>> Thanks, Prashant. All right.
Prashant Prahlad
>> See you.
Dave Vellante
>> Okay. And thank you for watching. This is Dave Vellante for Christophe Bertrand and Jon Oltsik. The entire CUBE team here at RSAC 2026 in Moscone West. We'll be right back, right after this short break.
Dave Vellante