use Benchmark;

my $string = "1234567890";

timethese(-5, {
                'Regexp'      => sub { $string =~ s/(.*?)(....)$/("X" x length($1)).$2/e; },
                'Regexp D&P'  => sub { $string =~ s/.(?!.{0,3}$)/x/g; },
                'Substring'   => sub { $string = length substr($string,0,-4). substr($string,-4) }
              });

##</code><code>##

Benchmark: running Regexp, Regexp D&P, Substring, each for at least 5 CPU seconds...
    Regexp:  6 wallclock secs ( 5.38 usr +  0.00 sys =  5.38 CPU) @ 173245.35/s (n=932060)
Regexp D&P:  6 wallclock secs ( 5.30 usr +  0.00 sys =  5.30 CPU) @ 200480.57/s (n=1062547)
 Substring:  7 wallclock secs ( 5.45 usr +  0.00 sys =  5.45 CPU) @ 1004355.05/s (n=5473735)