Apricorn has released findings from its annual survey into encryption policies, conducted among IT security decision makers. The survey revealed that almost half (46%) of organizations now require all data to be encrypted as standard, whether at rest or in transit – this is double the percentage from 2023 (23%) and marks a pivotal shift as more companies recognise the critical role of encryption in safeguarding sensitive information.
The findings also revealed a significant uptick in the adoption of encryption with organizations clearly taking steps to enhance their data protection strategies.
96% of organizations now enforce a policy that mandates encryption for all data held on removable media. This is in line with last year’s research which highlighted intentions to expand encryption usage, showing that those plans have now been followed through, particularly with hardware encryption and securing remote and mobile IT equipment.
Additionally, 44% said they only permit the use of hardware-encrypted, organization-approved removable media, a significant increase from just 22% last year. This shows a growing reliance on hardware encryption to secure portable devices that are often exposed to greater risks of theft or loss. This is particularly notable given the increased need to manage and secure data in increasingly flexible working environments, where personal devices are becoming more integrated into corporate operations.
These results demonstrate a clear shift in mindset, with organizations now following through on their plans to ramp up encryption efforts. The surge in hardware-encrypted devices, particularly for removable media and mobile devices, reflects a growing understanding that encryption is not just a best practice but a necessity in today’s threat landscape.
Jon Fielding, Managing Director, EMEA Apricorn
Several factors have driven the increase in encryption implementation over the past year. The top five reasons cited by IT security decision-makers surveyed are: to better protect data (28%), to allow them to securely share files (18%), the rise in remote working (20%), to avoid regulatory fines (11%), and to protect lost or stolen devices (11%).
These reasons reflect both the evolving security landscape and the pressures of regulatory compliance, as well as the practical challenges posed by remote working and the need to share sensitive data securely.
Interestingly, there has been an improvement in understanding which data sets also need to be encrypted. Only 7% of organizations surveyed admitted they lacked clarity on which data sets require encryption, a notable improvement from 14% in 2023. This suggests that businesses are gaining better visibility over their data assets and how to protect them effectively. This is a positive step, especially given that almost three-quarters of those surveyed (74%) also said that their organization’s mobile/remote workers are willing to comply with security measures, but they don’t have the necessary skills or technology to keep data safe.
When questioned on the main causes of a data breach within their organization, whilst phishing (34%) and ransomware (31%) topped the list, 22% cited a lack of encryption – an increase of 5% compared with 2023 findings.
