What It Actually Means
In transit protects data moving between places: your browser and the website, the application and its database, one service and another. This is what the padlock in the address bar indicates, and it is close to universal now.
At rest protects data sitting on a disk. If someone walks out with the drive, or gains access to the storage without the key, they get noise.
Both are worth having and both are usually present. Neither is the thing people believe it is.
What It Does Not Protect Against
This is the part that matters commercially, because “the data is encrypted” is offered as a complete answer far more often than it is one.
Encryption at rest protects against someone stealing the storage. It does not protect against someone logging into the application, because the application decrypts data as a matter of course for anyone holding valid credentials. That describes the overwhelming majority of real incidents.
Put plainly: if an attacker gets a working password, encryption at rest contributes nothing. The system politely decrypts everything for them, exactly as designed.
So when a supplier answers a security question with “it is all encrypted”, the useful follow-up is what that encryption is defending against. If the honest answer is “someone physically stealing the server”, that is a genuine but very unlikely threat, and the likely one has not been addressed.
Where It Genuinely Matters
Anything leaving your control. Backups going to another provider, exports on a laptop, files sent to a third party. Here the storage-theft threat is real and encryption is exactly right.
Particularly sensitive fields. Health details, financial records, identity documents. Encrypting these separately, with access limited to the small number of processes that need them, limits what a compromised account can reach.
Passwords, which are a special case. Passwords should not be encrypted at all, because encryption is reversible. They should be hashed, which is one-way, so nobody, including you, can recover the original. A supplier who says they encrypt passwords has said something concerning, and a service that can email you your existing password has proved it.
What To Ask
- What specific threat does this encryption address? A real answer names one.
- Who holds the keys? If they sit beside the data with the same access controls, the protection is largely notional.
- Are passwords hashed rather than encrypted? The answer should be immediate.
- What is encrypted beyond the defaults? Transit and at-rest are mostly automatic now, so they say little about how carefully the system was built.
The Honest Summary
Encryption is table stakes and it is not a security strategy. It is one control, addressing a narrow set of threats, and it is disproportionately talked about because it is easy to say and hard to check.
The controls that actually reduce risk at this scale are duller: who can log in, what a single compromised account can reach, whether anyone would notice, and whether you could recover. Encryption belongs on the list, and it is rarely the item that would have prevented the incident.
More terms are in the glossary.
