PK Protect for z/OS
Mainframe discovery and protection: security for critical z/OS data
PKWARE provides enterprise-wide discovery of z/OS applications and critical data elements to enable compliance and modernization. Backed by four decades of mainframe expertise and IBM Partner Plus status, we’re a proven leader in solving complex z/OS data security challenges.
Trusted by leading organizations for over 40 years
See what leaves the mainframe
Gain comprehensive visibility of z/OS application datasets
Organizations running on IBM z/OS often struggle to identify where sensitive data resides and how it’s used as it moves beyond the mainframe. This lack of visibility creates compliance challenges and security risks. PK Protect solves this by delivering discovery, paired with persistent encryption. This simplifies regulatory compliance, reduces risk, and accelerates modernization initiatives.
Why PK Protect for z/OS
You cannot protect, or migrate, what you cannot see
Uncover risks and ensure compliance
When mainframe data leaves z/OS, organizations lose track of where sensitive information exists, creating gaps. Our mainframe data security platform reveals these exposure risks with application and critical data element discovery. It helps you meet mandates, avoid fines, and accelerate SBOM creation, saving time during audits.
Quantum computing is reshaping compliance, and regulators aren’t waiting. NIST’s post-quantum cryptography standards mandate deprecation of weaker algorithms by 2030. NSA’s CNSA 2.0 transition milestones are already in effect. Compliance starts with knowing what data you have. Gain clarity across VSAM datasets, application data flows, and data leaving z/OS so you can meet deadlines without scrambling.
Speak to an expert
Prevent data leakage and enforce governance
PK Protect provides application discovery and encryption to prevent data exposure, at rest and in motion. It enables persistent encryption for data moving in and out of z/OS. Additionally, you can de-identify production data for safe use in lower environments, and secure sensitive information before it enters AI models. As a result, you ensure governance and minimize risk across the data lifecycle.
Speak to an expert
Support application modernization and cloud migration
Most organizations on the mainframe are modernizing workloads on z/OS or integrating them with the cloud, rather than moving off the platform. Our mainframe discovery solution supports this by scanning and harvesting mainframe metadata. Doing so prevents exposure during cloud migrations. It also maps legacy data to compliant cloud storage structures. This ensures sensitive data remains protected, simplifies audits, and strengthens long-term governance.
Speak to an expertReal world impact
$150M in fines avoided
One of the largest U.S. financial institutions faced a PCI DSS 4.0 compliance deadline. Using PK Protect for z/OS, they scanned 504 million VSAM records. These scans uncovered 422 million credit card numbers and 450 million Social Security numbers. In all, 88% were vulnerable and at risk. By identifying and securing this sensitive data, they avoided an estimated $150 million in potential fines. This demonstrates the importance of proactive discovery and protection.
Read the full blog
What it does
PK Protect for z/OS features
Precise discovery for application datasets
Our mainframe data security platform leverages application data definitions to identify sensitive data accurately. It even works within unstructured, binary streams lacking field headers. This visibility into application data and metadata eliminates manual mapping. You can then streamline compliance efforts and enhance audit readiness.
Learn more
End-to-end protection with persistent encryption
IBM Pervasive Encryption secures data on z/OS. However, that protection stops when data leaves the mainframe. Transfer protocols encrypt data in transit, but once data reaches its destination, it’s exposed. In a post-quantum world, even in-transit protection is at risk from “harvest now, decrypt later” attacks. Close these gaps with persistent, algorithm-agile encryption that stays with your data wherever it goes. As post-quantum standards like ML-KEM (FIPS 203) mature, our crypto agility lets you transition to encryption algorithms without disrupting the data lifecycle or re-engineering downstream applications.
Learn more
Your quantum-safe foundation
Threat actors are already intercepting and storing encrypted data to decrypt once quantum computers arrive. NIST, NSA, and global regulators require migration to quantum-safe cryptography by 2030–2035, and you can’t migrate what you can’t see. To transition to post-quantum algorithms like ML-KEM (FIPS 203) and ML-DSA (FIPS 204), you need visibility into every algorithm, key, certificate, and protocol across z/OS, including data that leaves the mainframe. We provide a discovery-first foundation to prioritize, plan, and migrate with confidence.
Learn more
More of the platform
Related products
PK Protect Data Store Manager
Reduce risk with proactive security across structured and unstructured data in databases, data lakes, cloud repositories, and packaged applications. Data Store Manager discovers and masks sensitive data everywhere, ensuring it remains safe even in the event of a breach.
Learn more
PK Protect Endpoint Manager
Secure sensitive user data at rest and in motion seamlessly with Endpoint Manager for continuous compliance and data security. You can find sensitive data and apply policy-driven protections, defined centrally, to label, encrypt, redact, move, delete, or quarantine it automatically.
Learn more
Questions
Mainframe discovery and protection FAQs
PK Protect for z/OS stands out because it can accurately map schemas for every application dataset on z/OS. This capability solves a problem that most solutions consider “unsolvable.” PK Protect uses data definitions to achieve precise discovery of sensitive data.
z/OS data sets often contain streams of unstructured binary data without field headers or recognizable structures. Without these markers, finding sensitive data is nearly impossible without additional context like data definitions.
Most solutions rely on scanning structured data sources such as DB2 and IMS databases. While structured data is relatively easy to handle, these solutions fail when it comes to unstructured z/OS datasets. They lack the ability to interpret raw binary streams correctly.
Data definitions provide the blueprint for understanding data organization within z/OS datasets. PK Protect leverages these resources to interpret and locate sensitive information, ensuring precise discovery and classification.
IBM Pervasive Encryption secures data on the mainframe, but what happens when you need to distribute it? When data moves out of the mainframe, the z-level security disappears. Transfer protocols encrypt data in transit, but once at its destination, it’s no longer protected. This creates a fragmented security model and introduces risk. PK Protect solves this by persistently protecting data, even when the data moves in and out of z/OS. This ensures end-to-end security and compliance, no matter where your data travels.
Quantum readiness starts with visibility. Before you can migrate to quantum-safe algorithms, you need a complete inventory of every cryptographic algorithm, key, and protocol in use across your IBM z/OS environment. This includes data that leaves the platform. PK Protect delivers this through precise application dataset discovery, helping you build a Cryptographic Bill of Materials (CBOM) as the foundation for migration plans. As you adopt PQC standards like ML-KEM (FIPS 203) and ML-DSA (FIPS 204) across your z/OS software stack, our quantum-safe encryption supports algorithm transitions without disrupting the data lifecycle.