Mark this is a great article. Can I check though if it still holds? It seems that in newer updates of Security center that the "value" field of the sys_variable_value table are detected, via the 'Deprecated API: Encrypter usages in Variables table' check. This now appears in 'Security Center Installed Version 1.3.4 on a Washington PDI'.