Disk encryption is a security control that protects data stored on a drive by converting it into unreadable ciphertext unless the correct key or passphrase is available. It is commonly built into laptops, phones, and removable media, and it can encrypt the whole disk or just specific volumes.
This matters because many real-world compromises start with physical access: a stolen laptop, a lost USB drive, or a removed storage device. Encryption does not stop a device from being taken, but it can prevent attackers from reading files, browser data, cached credentials, or corporate documents after theft. Defenders rely on it as part of endpoint protection, usually alongside strong authentication, secure key storage, and device management. For best results, encryption must be enabled before an incident, because data copied from an unencrypted drive is easy to recover.