Take control of your releases with a free, instant demo.

Launch Now

Author: Enov8

Enov8 Context(4).docx Document Search Visibility and Content Context(4).docx Document Editorial Context(4).docx Document I'm going to share a draft blog post for https://enov8.com/. See example posts on their site and also the guidelines that I've attached here. Make sure that the post follow's those guidelines, isn't passive. Make sure things aren't too repetitive. Draft is below: Broadcom Data Masking: What It Does and Where It Falls Short TL;DR: Broadcom's data masking lives inside CA Test Data Manager (CA TDM), where it replaces sensitive production values with realistic but fictitious substitutes so your test environments never hold real PII. You configure it through the TDM Portal, assigning masking functions by table or by tag, and run the work through the Fast Data Masker engine, which can run in Docker for scale. It does the core job well, but it comes with real friction: a hard concurrency cap, schemas that queue behind that cap, and infrastructure planning overhead. This post explains how the capability works and where it strains, then points to what teams with complex test-data needs often weigh alongside it. Test data is where a lot of quiet risk lives. Every time a team spins up a new environment, duplicates a database for analytics, or shares a dataset with a vendor, a copy of sensitive data spreads a little further. Without clear governance, protection turns inconsistent as those copies multiply. Getting it wrong is expensive. Drawing on IBM's 2025 Cost of a Data Breach Report, Huntress reports that the average breach now runs $4.4 million globally, climbing to $5.56 million in finance and $7.42 million in healthcare. Masking is how teams pull sensitive data out of that blast radius. Here's how Broadcom does it. What Broadcom Data Masking Is Data masking replaces sensitive information — PII, financial data, protected health information — with fictional but realistic substitutes, as Dataintelo describes it. The point is to keep the data usable for testing while making it useless to anyone outside its authorized context. In the Broadcom ecosystem, data masking lives inside CA Test Data Manager (CA TDM), where it swaps real production values for realistic fictitious ones so test environments never expose regulated data. The work happens in the TDM Portal. Broadcom's documentation explains that the TDM Portal folds tasks that once required separate tools into one place, and a test data engineer masks data there using the Fast Data Masker engine. One constraint shapes everything downstream: masking is scoped to a data model. Per Broadcom's docs, you can only mask data that sits in a CA TDM data model. Define the model first, then mask what's in it. How the Masking Process Works Underneath the portal, masking in CA TDM runs on the Fast Data Masker (FDM) engine. Broadcom's documentation explains that the portal uses FDM to mask data, and its masking functions are specific to data types such as VARCHAR, DATE, and NUMBER. Those functions get bundled into reusable configurations. The docs define Mask Function Groups as configurations of masking functions, set in an execution order with seedlists as parameters where appropriate, that the portal uses to generate FDM jobs. Here's what one looks like: the built-in "Post Code (UK)" group contains a single masking function, HASHLOV, and specifies the "UK Post Codes" seedlist as its parameter. The next three sections walk through how you configure a job, how the engine runs it, and what happens at runtime. 1. Configuring Masking Jobs in the TDM Portal Masking in the portal is tag-driven. Broadcom's docs explain that the portal masks columns with Mask Function Groups based on tags you assign to columns, and you can assign those tags two ways: through a PII scan or manually. From there, the flow moves through select model, configure, masking settings, and start masking, with each run tracked on the Masking Jobs page. You have two paths for reviewing and adjusting what gets masked. One is the table view, where the docs note that each row represents a tag in the data model. Clicking the plus icon opens the expanded tag view, which surfaces the tag's default Mask Function Group. That second view is where the nuance shows up. If you mask columns carrying the same tag with different functions, the field displays "Multiple functions." One tag can fan out into several distinct masking behaviors. 2. How the Remote Masking Engine Operates in Docker Starting with Test Data Manager 4.8, Broadcom made the Masking Engine available as a Docker container. Per the docs, the Masking Engine container performs masking tasks with the Fast Data Masker engine. It doesn't act alone. Between the portal and the engine sits a messaging layer. Broadcom's documentation describes a Messaging container holding a Java Messaging Service queue of the tasks that make up a masking job, distributing them to the engine containers over RabbitMQ. The engine containers pick tasks off that queue and do the actual masking. The reason for this architecture is scale. The docs explain that it lets you distribute masking jobs across multiple hosts to run concurrently. That power comes with setup cost. The same guidance tells you to pull a specific Apache ZooKeeper Docker image before scaling out. 3. What Happens at Runtime At runtime, the flow moves one direction through the stack. Broadcom's docs describe how the TDM Portal service, whether running in Windows or Docker, sends masking jobs — split into tasks -- to the messaging container, which hands those tasks to the engine containers, which perform the masking with FDM. How that plays out depends on how you've deployed it. Broadcom documents four topologies, ranging from portal and engines both in Docker to the portal in Windows with engines in Docker. The right shape depends on your existing infrastructure and how much you need to scale. The result on the other side is a provisioned test environment carrying structurally intact data with the sensitive values swapped out. Bloor Research notes that CA TDM keeps masked data referentially intact, is fully auditable, and can mask millions of rows in minutes either in-place or in-flight. That referential integrity is what makes the masked output usable for real testing. Where Broadcom Data Masking Has Limits The tool does the core job, and does it in a compliant, auditable way. But a practitioner should go in knowing where the friction is. The first is concurrency. Broadcom's own guidance sets a hard ceiling of four concurrent FDM instances, both the default and the recommended maximum, since more than that loads the host too heavily. That cap bites harder the more schemas you have. The same documentation treats each database or schema as one masking task. With ten single-schema connection profiles and a maximum of four instances, four run and the other six queue until an instance frees up. Masking across many schemas isn't parallel. It's throttled by that ceiling. There's also an infrastructure planning burden. The docs note that total memory for a job equals the sum of memory across every concurrent FDM instance, so resource needs scale linearly with parallelism. Add Docker containers, a messaging layer, a ZooKeeper dependency, custom seedtables that must be copied into the right volume, and four possible deployment topologies, and the honest summary is that the capability is powerful but standing it up and scaling it takes real work. What to Consider Alongside It Organizations with complex test-data needs rarely rely on a single tool. Masking is one layer. Provisioning realistic environments fast, without duplicating full production datasets, is another. When the schema count is high or environments need to spin up quickly, teams often look at how their masking approach fits the rest of their test-data pipeline. If you're weighing where Broadcom's approach has gaps — around scaling, environment provisioning, or lightweight test data on demand -- it's worth seeing how Enov8's Virtualize handles environment and test-data delivery, and where Enov8's broader test data management capabilities complement or replace what you have. The point isn't swapping tools for their own sake. It's making sure the masking layer and the Shorten this title slightly: Broadcom Data Masking: What It Does and Where It Falls Short Broadcom Data Masking: Capabilities and Limitations Give me a meta descriptin Learn how Broadcom data masking works in CA TDM, its key capabilities and limitations, and what to consider for complex test data needs. Now generate a featured image for this post based on the ones on Enov8's site and don't include any text Created a text-free featured image for the Broadcom data masking post, using Enov8’s blue, polished enterprise-technology aesthetic. Edit Give me alt text Secure database protected by a digital shield as masked data flows across a connected network.

Broadcom Data Masking: Capabilities and Limitations
September 15, 2026 By Enov8

Test data creates a significant but often overlooked source of risk. Every time a team creates an environment, copies a production database, or shares a dataset with a vendor, sensitive information spreads further. Without clear governance, data protection becomes inconsistent as those copies multiply. The financial consequences can be substantial. Drawing on IBM’s 2025 Cost […]

Read More
Glowing software packages move through checkpoints toward production servers, illustrating controlled release management in ITIL.

Release Management in ITIL: Complete Guide & Best Practices
September 12, 2026 By Enov8

Managing enterprise software production at scale is no easy task. This is especially true in today’s complex and distributed environment where teams are spread out across multiple geographical areas. To maintain control over so many moving parts, IT leaders need to break down silos and standardize processes. Luckily, they don’t have to reinvent the wheel […]

Read More
Futuristic software release passing through a glowing green readiness checkpoint in a digital enterprise environment. Release Readiness.

What Is Release Readiness? A Complete Guide
September 9, 2026 By Enov8

Most software teams know how to deploy an application. The harder question is whether they can deploy it confidently. A release may pass its functional tests but still create problems in production. An unavailable test environment, unresolved security risk, missing approval, or incomplete rollback plan can turn an otherwise successful build into a failed release. […]

Read More
Miniature servers and glowing data cubes enclosed in a glass dome, representing an isolated test environment within a larger software infrastructure.

Test Environment: What It Is and Why It Matters in Testing
September 5, 2026 By Enov8

Software development is a complex process that requires meticulous attention to detail to ensure that the final product is reliable and of high quality. One of the most critical aspects of this process is testing, and having a dedicated test environment is essential to guaranteeing the accuracy and functionality of software. Unfortunately, many development teams […]

Read More
Digital data stream splitting between a padlock for encryption and a shield for data masking.

Data Masking vs. Encryption: How to Choose the Right One
September 4, 2026 By Enov8

For the first time in five years, the average cost of a data breach fell. IBM’s 2025 Cost of a Data Breach Report found that the global average dropped 9% to $4.44 million. The report also ranked encryption among the leading controls for reducing breach costs. However, encryption is not the only way to protect […]

Read More