Here’s the fork in the road after a laptop vanishes from a car, a coffee shop, or an airport tray: on an encrypted machine, the thief has hardware — the data is mathematically unreadable without the key, and the story ends with an insurance claim for a laptop. On an unencrypted one, the thief has everything the machine held — the files, the cached email, the saved sessions — and the story may end with breach-notification letters, because most privacy laws treat lost unencrypted personal data as a reportable breach and lost encrypted data, generally, as a lost brick. One setting decides which story you’re in. Here’s making sure it’s the right one, fleet-wide.
How it works, and why there’s no performance excuse left
Full-disk encryption — BitLocker on Windows, FileVault on Mac — scrambles everything on the drive, transparently: the authorized user signs in and works normally; anyone without the credentials, including someone who pulls the drive and mounts it elsewhere, gets noise. Modern machines do the math in hardware, so the decade-old “encryption slows things down” objection is dead — the performance cost on current hardware rounds to zero, which removes the last respectable reason any business device ships without it. The scope question answers itself from the threat: anything that leaves the building — every laptop, first and non-negotiably — plus desktops (they get stolen in burglaries, and they eventually get disposed of, where encryption converts drive-wiping diligence into a formality), servers where physical security is thin, and phones and tablets, which modern OSes encrypt by default when a passcode is enforced — the enforcement being the actual control.
The recovery-key detail that bites
Encryption has one operational teeth-mark worth respecting: the recovery key — the fallback that unlocks a drive when the normal path fails (a hardware change, a forgotten password, a repair). Two failure modes, both common: keys stored nowhere, discovered when a legitimate machine needs recovery and the data is now protected from you — encryption’s own friendly-fire; and keys stored somewhere terrible — a text file on the desktop, a personal Microsoft account, the departed employee’s private stash. The fix is central escrow, automatic: business deployment via Intune or your management tooling stores every recovery key in the tenant, retrievable by admins, access-logged. If your machines were encrypted by individual hands over the years, the audit question is blunt: for each encrypted device, where is its recovery key, and can IT produce it right now?
Enforced, not encouraged
Like every control in this library, encryption “available” protects volunteers; encryption enforced protects the company. Managed fleets make it policy: every enrolled machine encrypts automatically, keys escrow automatically, and — the reporting half — compliance is visible: a dashboard answer to “what percentage of devices are encrypted?” rather than a hopeful guess. That number belongs in the quarterly metrics, and it’s precisely what the insurance application and every HIPAA-adjacent obligation mean when they ask about encryption — a stolen unencrypted laptop with patient or client data aboard is the single most preventable reportable incident in small business, and “we encrypt where we remembered to” is the answer that fails audits.
The bottom line
Device encryption is the rare control with no trade-off left: free on modern licensing, invisible in daily use, and the difference between “we lost a laptop” and “we lost the data of everyone in it.” Enforce it by policy across everything portable, escrow every recovery key centrally, keep the compliance percentage on the quarterly page — and the next vanished laptop becomes what it should be: an inventory update and a claim form, with the story ending exactly where the mathematics said it would.