Take control of your releases with a free, instant demo.

Launch Now

Tag: Test Data Management

Enov8 Context(4).docx Document Search Visibility and Content Context(4).docx Document Editorial Context(4).docx Document I'm going to share a draft blog post for https://enov8.com/. See example posts on their site and also the guidelines that I've attached here. Make sure that the post follow's those guidelines, isn't passive. Make sure things aren't too repetitive. Draft is below: Broadcom Data Masking: What It Does and Where It Falls Short TL;DR: Broadcom's data masking lives inside CA Test Data Manager (CA TDM), where it replaces sensitive production values with realistic but fictitious substitutes so your test environments never hold real PII. You configure it through the TDM Portal, assigning masking functions by table or by tag, and run the work through the Fast Data Masker engine, which can run in Docker for scale. It does the core job well, but it comes with real friction: a hard concurrency cap, schemas that queue behind that cap, and infrastructure planning overhead. This post explains how the capability works and where it strains, then points to what teams with complex test-data needs often weigh alongside it. Test data is where a lot of quiet risk lives. Every time a team spins up a new environment, duplicates a database for analytics, or shares a dataset with a vendor, a copy of sensitive data spreads a little further. Without clear governance, protection turns inconsistent as those copies multiply. Getting it wrong is expensive. Drawing on IBM's 2025 Cost of a Data Breach Report, Huntress reports that the average breach now runs $4.4 million globally, climbing to $5.56 million in finance and $7.42 million in healthcare. Masking is how teams pull sensitive data out of that blast radius. Here's how Broadcom does it. What Broadcom Data Masking Is Data masking replaces sensitive information — PII, financial data, protected health information — with fictional but realistic substitutes, as Dataintelo describes it. The point is to keep the data usable for testing while making it useless to anyone outside its authorized context. In the Broadcom ecosystem, data masking lives inside CA Test Data Manager (CA TDM), where it swaps real production values for realistic fictitious ones so test environments never expose regulated data. The work happens in the TDM Portal. Broadcom's documentation explains that the TDM Portal folds tasks that once required separate tools into one place, and a test data engineer masks data there using the Fast Data Masker engine. One constraint shapes everything downstream: masking is scoped to a data model. Per Broadcom's docs, you can only mask data that sits in a CA TDM data model. Define the model first, then mask what's in it. How the Masking Process Works Underneath the portal, masking in CA TDM runs on the Fast Data Masker (FDM) engine. Broadcom's documentation explains that the portal uses FDM to mask data, and its masking functions are specific to data types such as VARCHAR, DATE, and NUMBER. Those functions get bundled into reusable configurations. The docs define Mask Function Groups as configurations of masking functions, set in an execution order with seedlists as parameters where appropriate, that the portal uses to generate FDM jobs. Here's what one looks like: the built-in "Post Code (UK)" group contains a single masking function, HASHLOV, and specifies the "UK Post Codes" seedlist as its parameter. The next three sections walk through how you configure a job, how the engine runs it, and what happens at runtime. 1. Configuring Masking Jobs in the TDM Portal Masking in the portal is tag-driven. Broadcom's docs explain that the portal masks columns with Mask Function Groups based on tags you assign to columns, and you can assign those tags two ways: through a PII scan or manually. From there, the flow moves through select model, configure, masking settings, and start masking, with each run tracked on the Masking Jobs page. You have two paths for reviewing and adjusting what gets masked. One is the table view, where the docs note that each row represents a tag in the data model. Clicking the plus icon opens the expanded tag view, which surfaces the tag's default Mask Function Group. That second view is where the nuance shows up. If you mask columns carrying the same tag with different functions, the field displays "Multiple functions." One tag can fan out into several distinct masking behaviors. 2. How the Remote Masking Engine Operates in Docker Starting with Test Data Manager 4.8, Broadcom made the Masking Engine available as a Docker container. Per the docs, the Masking Engine container performs masking tasks with the Fast Data Masker engine. It doesn't act alone. Between the portal and the engine sits a messaging layer. Broadcom's documentation describes a Messaging container holding a Java Messaging Service queue of the tasks that make up a masking job, distributing them to the engine containers over RabbitMQ. The engine containers pick tasks off that queue and do the actual masking. The reason for this architecture is scale. The docs explain that it lets you distribute masking jobs across multiple hosts to run concurrently. That power comes with setup cost. The same guidance tells you to pull a specific Apache ZooKeeper Docker image before scaling out. 3. What Happens at Runtime At runtime, the flow moves one direction through the stack. Broadcom's docs describe how the TDM Portal service, whether running in Windows or Docker, sends masking jobs — split into tasks -- to the messaging container, which hands those tasks to the engine containers, which perform the masking with FDM. How that plays out depends on how you've deployed it. Broadcom documents four topologies, ranging from portal and engines both in Docker to the portal in Windows with engines in Docker. The right shape depends on your existing infrastructure and how much you need to scale. The result on the other side is a provisioned test environment carrying structurally intact data with the sensitive values swapped out. Bloor Research notes that CA TDM keeps masked data referentially intact, is fully auditable, and can mask millions of rows in minutes either in-place or in-flight. That referential integrity is what makes the masked output usable for real testing. Where Broadcom Data Masking Has Limits The tool does the core job, and does it in a compliant, auditable way. But a practitioner should go in knowing where the friction is. The first is concurrency. Broadcom's own guidance sets a hard ceiling of four concurrent FDM instances, both the default and the recommended maximum, since more than that loads the host too heavily. That cap bites harder the more schemas you have. The same documentation treats each database or schema as one masking task. With ten single-schema connection profiles and a maximum of four instances, four run and the other six queue until an instance frees up. Masking across many schemas isn't parallel. It's throttled by that ceiling. There's also an infrastructure planning burden. The docs note that total memory for a job equals the sum of memory across every concurrent FDM instance, so resource needs scale linearly with parallelism. Add Docker containers, a messaging layer, a ZooKeeper dependency, custom seedtables that must be copied into the right volume, and four possible deployment topologies, and the honest summary is that the capability is powerful but standing it up and scaling it takes real work. What to Consider Alongside It Organizations with complex test-data needs rarely rely on a single tool. Masking is one layer. Provisioning realistic environments fast, without duplicating full production datasets, is another. When the schema count is high or environments need to spin up quickly, teams often look at how their masking approach fits the rest of their test-data pipeline. If you're weighing where Broadcom's approach has gaps — around scaling, environment provisioning, or lightweight test data on demand -- it's worth seeing how Enov8's Virtualize handles environment and test-data delivery, and where Enov8's broader test data management capabilities complement or replace what you have. The point isn't swapping tools for their own sake. It's making sure the masking layer and the Shorten this title slightly: Broadcom Data Masking: What It Does and Where It Falls Short Broadcom Data Masking: Capabilities and Limitations Give me a meta descriptin Learn how Broadcom data masking works in CA TDM, its key capabilities and limitations, and what to consider for complex test data needs. Now generate a featured image for this post based on the ones on Enov8's site and don't include any text Created a text-free featured image for the Broadcom data masking post, using Enov8’s blue, polished enterprise-technology aesthetic. Edit Give me alt text Secure database protected by a digital shield as masked data flows across a connected network.

Broadcom Data Masking: Capabilities and Limitations
September 15, 2026 By Enov8

Test data creates a significant but often overlooked source of risk. Every time a team creates an environment, copies a production database, or shares a dataset with a vendor, sensitive information spreads further. Without clear governance, data protection becomes inconsistent as those copies multiply. The financial consequences can be substantial. Drawing on IBM’s 2025 Cost […]

Read More
A dark blue tech-themed background with glowing circuit lines pointing toward a green MongoDB leaf in the center for the post about MongoDB Clone Database Explained

MongoDB Clone Database Explained: Methods and Best Practices
September 10, 2026 By Enov8

Every engineering team relies on MongoDB cloning, but very few do it safely at scale. What starts as a simple way to copy data often turns into security risks, rising costs, and inconsistent environments. Teams clone a MongoDB database to create safe, non-production copies for development, testing, analytics, and recovery. As a result, it is […]

Read More
Picture of a hand with an emphasis on the fingerprints to pair with the post about Data Anonymization Tools

Data Anonymization Tools: 9 Top Options to Compare in 2026
September 9, 2026 By Enov8

A common risk in modern software delivery is using copies of production data for development and testing. These environments rely on realistic datasets but often include sensitive customer, financial, or health data that should not leave production systems. However, data anonymization tools solve this by transforming sensitive data into safe versions that still behave like […]

Read More
Person typing on a laptop to represent the post incorporating test data and data compliance in devops

Test Data Management in DevOps: Why Data Compliance Matters
September 5, 2026 By Enov8

DevOps, a word that combines “development” and “operations,” is a business process that shortens the time taken to gather customer feedback. Besides, it also enables progressive software delivery and helps clients capture market opportunities. But sometimes, during testing, even the most skilled testers in a DevOps organization can make a mistake. They can overlook a […]

Read More
illustration of a book with data inscribed for the post about data literacy

What Is Data Literacy? Definition, Benefits, and Challenges
September 4, 2026 By Enov8

Technically, the world today has advanced to a level we never could’ve imagined a few years ago. What do you think made it possible? We now understand complexities. And how do you think that became possible? Literacy! Since the beginning of time, ignorance was rampant.  Only when humans decided to focus on literacy did big […]

Read More