How This CVS And Regions Bank Alum Turns Data Liability Into A Governed Asset

Modern enterprises are collecting more sensitive data than ever, but much of it sits idle. Fears of misuse, compliance violations, and reputational harm often prevent companies from acting on their most valuable insights, leaving potential gold to decay into liability.

Jyothsna Santosh is a cross-industry AI and Data Science leader who has delivered measurable impact in regulated industries like healthcare at CVS Health and finance at Regions Bank. Her work focuses on building human-centered, trusted AI systems to drive growth and personalization. She spoke with CIO News about strategies leaders can use to reframe the problem, turning their riskiest data from a regulatory burden into a governed asset.

For Santosh, a key part of the solution lies in a well-architected digital twin that serves as a governed replica of a company’s most sensitive enterprise data. By tokenizing customer records and supplementing them with statistically valid synthetic data, the twin creates a safe but realistic mirror that organizations can use with confidence. "By building and using a digital twin, teams can go to market faster while keeping customer data safe."

• The whole elephant: But she cautioned that the value is often lost in fragmented efforts. Many organizations try to build a digital twin only for a single domain, without connecting it to the rest of the enterprise. The result is an incomplete picture that keeps insights siloed. "If you're only looking at one part of the elephant, you miss the other side. It feels very siloed, and you don't get the holistic insight that you want," said Santosh.

A true digital twin is a pragmatic, hybrid architecture built for enterprise scale. A primary goal is to create a trustworthy and cost-effective mirror, one that blends full tokenization for core records with statistically validated synthetic data for everything else.

• Governance as a feature: "You need to treat de-anonymization as a deliberate feature. This means ensuring only people with the right privileges can de-tokenize the data, that you have the proper logs to track it, and that all of that activity is being monitored."

• Smarter, not bigger: "Since it's too expensive to replicate all enterprise data, the goal is to ensure the statistical distribution of your synthetic data closely mirrors the original. When distributions are validated with checkpoints, the synthetic data can be trusted for many types of analysis."