Encryption defends a narrower set of things than the marketing implies. Here is where the real line sits.
What an encrypted device actually protects against
Encryption is precise about what it defends, and vague marketing around it does real harm. Being clear is more useful than being impressive.
Encryption at rest protects data on a device that is powered off or locked, against someone who has physical possession of it. That is a genuine and common threat — a laptop in a car, a phone in a taxi, a drive that leaves a building — and full-disk encryption solves it well. It does nothing against malware running on the device while you are using it, because at that point the data is decrypted for you and therefore for the malware.
Encryption in transit protects a message between two points against interception on the wire. End-to-end encryption extends that so the provider in the middle cannot read the content either. Neither protects the endpoints: if either device is compromised, the attacker reads the message where it is displayed, and no amount of transport security changes that.
The practical conclusion is the one that matters. Endpoint compromise defeats encryption. Any product marketed as an “unhackable phone” is making a claim about a category of device that does not exist. What good hardware and configuration do is raise cost and reduce attack surface, which is worth buying — and it is not the same as immunity.
The controls that actually change the outcome
Full-disk encryption, enabled and verified. Most modern devices support it and many organisations have never confirmed it is on across the estate. Verification is a five-minute task with a large payoff.
Passphrases and biometrics, understood correctly. A long passphrase resists offline attack; a short PIN does not. Biometrics are convenient and have a different legal profile from something you know, which is worth understanding before it matters rather than after.
Managed devices. Enrolment, policy enforcement, patch state, and — critically — tested remote wipe. Remote wipe that has never been exercised is a hope. It also has a hard limit: it only works if the device connects, which a competent adversary will prevent.
Separation. Work data on managed devices, personal data separate, with a defined position on what happens when an employee leaves. Bring-your-own-device arrangements without a written boundary create both a security gap and a privacy problem.
Backup before hardening. Encryption without a tested recovery path is how organisations lose data to themselves — a forgotten passphrase, a failed drive, a departed employee. Recovery keys need escrow, and the escrow needs testing.
Communications. Choosing a platform on its actual properties — who holds the keys, what metadata is retained, how identity is verified, whether messages expire, what happens on backup — rather than on how private it sounds. Metadata is frequently more revealing than content, and it is the part most people never consider.
What Honeybadger Solutions provides
Honeybadger Solutions is an Arizona-licensed security guard and private investigations agency — Guard 1759798, PI 1759795 — with investigations, digital forensics and cyber work delivered nationwide. This article is background on the problem. For what we actually provide, see Encrypted Devices, or book a confidential consultation.