Take control of your releases with a free, instant demo.

Launch Now

Author: Enov8

Deployment planning illustration showing connected application platforms, a validation checkpoint, production servers, and an alternate recovery path.

Deployment Planning: Steps, Strategies and Best Practices
September 26, 2026 By Enov8

Deployment planning, sometimes referred to as “implementation planning,” is the process of creating a plan for the successful deployment of a new software or system. It involves identifying the resources, tasks, and timeline needed to ensure that the deployment is successful. Deployment planning also includes risk assessment and contingency planning to ensure that any potential […]

Read More
Deployment pipeline reversing from a failed release to a stable server environment.

Deployment Rollback: Strategies, Triggers, and Trade-Offs
September 21, 2026 By Enov8

Every release carries risk. A team can test in staging, review the code, and run the deployment pipeline successfully, yet still introduce a regression, broken integration, or unexpected performance issue in production. When that happens, the team needs a reliable way to restore service. A deployment rollback returns an application or service to a previously […]

Read More
Interconnected blue and gold blocks arranged in tiers, representing teams, Agile Release Trains, and portfolio coordination in the SAFe hierarchy.

SAFe Hierarchy Explained: Seven Levels, Roles and Structure
September 19, 2026 By Enov8

The Scaled Agile Framework (SAFe) is a comprehensive set of principles and practices designed to help organizations adopt agile methods on an enterprise level. It provides a set of guidelines and best practices that enable large-scale product development with agility. At its core, SAFe has a hierarchical structure, which assigns different roles and responsibilities in […]

Read More

Agents Can’t Smell Bad Data
September 18, 2026 By Enov8

Why Test Data Just Became an AI Governance Problem In late August, Thoughtworks published a lengthy field guide on what it takes to make enterprise data ready for agentic AI. Its central claim is simple: a human analyst who runs into a number that looks wrong pauses and double-checks it. An autonomous agent has no […]

Read More
Enov8 Context(4).docx Document Search Visibility and Content Context(4).docx Document Editorial Context(4).docx Document I'm going to share a draft blog post for https://enov8.com/. See example posts on their site and also the guidelines that I've attached here. Make sure that the post follow's those guidelines, isn't passive. Make sure things aren't too repetitive. Draft is below: Broadcom Data Masking: What It Does and Where It Falls Short TL;DR: Broadcom's data masking lives inside CA Test Data Manager (CA TDM), where it replaces sensitive production values with realistic but fictitious substitutes so your test environments never hold real PII. You configure it through the TDM Portal, assigning masking functions by table or by tag, and run the work through the Fast Data Masker engine, which can run in Docker for scale. It does the core job well, but it comes with real friction: a hard concurrency cap, schemas that queue behind that cap, and infrastructure planning overhead. This post explains how the capability works and where it strains, then points to what teams with complex test-data needs often weigh alongside it. Test data is where a lot of quiet risk lives. Every time a team spins up a new environment, duplicates a database for analytics, or shares a dataset with a vendor, a copy of sensitive data spreads a little further. Without clear governance, protection turns inconsistent as those copies multiply. Getting it wrong is expensive. Drawing on IBM's 2025 Cost of a Data Breach Report, Huntress reports that the average breach now runs $4.4 million globally, climbing to $5.56 million in finance and $7.42 million in healthcare. Masking is how teams pull sensitive data out of that blast radius. Here's how Broadcom does it. What Broadcom Data Masking Is Data masking replaces sensitive information — PII, financial data, protected health information — with fictional but realistic substitutes, as Dataintelo describes it. The point is to keep the data usable for testing while making it useless to anyone outside its authorized context. In the Broadcom ecosystem, data masking lives inside CA Test Data Manager (CA TDM), where it swaps real production values for realistic fictitious ones so test environments never expose regulated data. The work happens in the TDM Portal. Broadcom's documentation explains that the TDM Portal folds tasks that once required separate tools into one place, and a test data engineer masks data there using the Fast Data Masker engine. One constraint shapes everything downstream: masking is scoped to a data model. Per Broadcom's docs, you can only mask data that sits in a CA TDM data model. Define the model first, then mask what's in it. How the Masking Process Works Underneath the portal, masking in CA TDM runs on the Fast Data Masker (FDM) engine. Broadcom's documentation explains that the portal uses FDM to mask data, and its masking functions are specific to data types such as VARCHAR, DATE, and NUMBER. Those functions get bundled into reusable configurations. The docs define Mask Function Groups as configurations of masking functions, set in an execution order with seedlists as parameters where appropriate, that the portal uses to generate FDM jobs. Here's what one looks like: the built-in "Post Code (UK)" group contains a single masking function, HASHLOV, and specifies the "UK Post Codes" seedlist as its parameter. The next three sections walk through how you configure a job, how the engine runs it, and what happens at runtime. 1. Configuring Masking Jobs in the TDM Portal Masking in the portal is tag-driven. Broadcom's docs explain that the portal masks columns with Mask Function Groups based on tags you assign to columns, and you can assign those tags two ways: through a PII scan or manually. From there, the flow moves through select model, configure, masking settings, and start masking, with each run tracked on the Masking Jobs page. You have two paths for reviewing and adjusting what gets masked. One is the table view, where the docs note that each row represents a tag in the data model. Clicking the plus icon opens the expanded tag view, which surfaces the tag's default Mask Function Group. That second view is where the nuance shows up. If you mask columns carrying the same tag with different functions, the field displays "Multiple functions." One tag can fan out into several distinct masking behaviors. 2. How the Remote Masking Engine Operates in Docker Starting with Test Data Manager 4.8, Broadcom made the Masking Engine available as a Docker container. Per the docs, the Masking Engine container performs masking tasks with the Fast Data Masker engine. It doesn't act alone. Between the portal and the engine sits a messaging layer. Broadcom's documentation describes a Messaging container holding a Java Messaging Service queue of the tasks that make up a masking job, distributing them to the engine containers over RabbitMQ. The engine containers pick tasks off that queue and do the actual masking. The reason for this architecture is scale. The docs explain that it lets you distribute masking jobs across multiple hosts to run concurrently. That power comes with setup cost. The same guidance tells you to pull a specific Apache ZooKeeper Docker image before scaling out. 3. What Happens at Runtime At runtime, the flow moves one direction through the stack. Broadcom's docs describe how the TDM Portal service, whether running in Windows or Docker, sends masking jobs — split into tasks -- to the messaging container, which hands those tasks to the engine containers, which perform the masking with FDM. How that plays out depends on how you've deployed it. Broadcom documents four topologies, ranging from portal and engines both in Docker to the portal in Windows with engines in Docker. The right shape depends on your existing infrastructure and how much you need to scale. The result on the other side is a provisioned test environment carrying structurally intact data with the sensitive values swapped out. Bloor Research notes that CA TDM keeps masked data referentially intact, is fully auditable, and can mask millions of rows in minutes either in-place or in-flight. That referential integrity is what makes the masked output usable for real testing. Where Broadcom Data Masking Has Limits The tool does the core job, and does it in a compliant, auditable way. But a practitioner should go in knowing where the friction is. The first is concurrency. Broadcom's own guidance sets a hard ceiling of four concurrent FDM instances, both the default and the recommended maximum, since more than that loads the host too heavily. That cap bites harder the more schemas you have. The same documentation treats each database or schema as one masking task. With ten single-schema connection profiles and a maximum of four instances, four run and the other six queue until an instance frees up. Masking across many schemas isn't parallel. It's throttled by that ceiling. There's also an infrastructure planning burden. The docs note that total memory for a job equals the sum of memory across every concurrent FDM instance, so resource needs scale linearly with parallelism. Add Docker containers, a messaging layer, a ZooKeeper dependency, custom seedtables that must be copied into the right volume, and four possible deployment topologies, and the honest summary is that the capability is powerful but standing it up and scaling it takes real work. What to Consider Alongside It Organizations with complex test-data needs rarely rely on a single tool. Masking is one layer. Provisioning realistic environments fast, without duplicating full production datasets, is another. When the schema count is high or environments need to spin up quickly, teams often look at how their masking approach fits the rest of their test-data pipeline. If you're weighing where Broadcom's approach has gaps — around scaling, environment provisioning, or lightweight test data on demand -- it's worth seeing how Enov8's Virtualize handles environment and test-data delivery, and where Enov8's broader test data management capabilities complement or replace what you have. The point isn't swapping tools for their own sake. It's making sure the masking layer and the Shorten this title slightly: Broadcom Data Masking: What It Does and Where It Falls Short Broadcom Data Masking: Capabilities and Limitations Give me a meta descriptin Learn how Broadcom data masking works in CA TDM, its key capabilities and limitations, and what to consider for complex test data needs. Now generate a featured image for this post based on the ones on Enov8's site and don't include any text Created a text-free featured image for the Broadcom data masking post, using Enov8’s blue, polished enterprise-technology aesthetic. Edit Give me alt text Secure database protected by a digital shield as masked data flows across a connected network.

Broadcom Data Masking: Capabilities and Limitations
September 15, 2026 By Enov8

Test data creates a significant but often overlooked source of risk. Every time a team creates an environment, copies a production database, or shares a dataset with a vendor, sensitive information spreads further. Without clear governance, data protection becomes inconsistent as those copies multiply. The financial consequences can be substantial. Drawing on IBM’s 2025 Cost […]

Read More