Pre-boot control is authentication or policy enforcement that happens before the operating system loads. In endpoint encryption, it typically appears as a pre-boot environment that asks for a PIN, password, smart card, or recovery method before the disk is unlocked. Because the operating system cannot start until this step succeeds, pre-boot control helps protect data even if an attacker removes the drive, boots from external media, or tries to bypass user-level defenses.
In cyber security, this matters because it strengthens full-disk encryption beyond simple storage protection. Defenders use it to reduce the value of stolen devices and to enforce stronger access rules at startup. Attackers may try to defeat it with firmware tampering, bootkits, or stolen credentials, so organizations need secure boot settings, tight recovery-key governance, and reliable enrollment procedures. The feature improves security, but it also adds operational complexity for help desks and fleet management.