What is encryption at rest versus encryption in transit?

Answer

Encryption at rest protects stored data on disks, databases, and backups so that someone who obtains the physical media or storage volume cannot read it, typically using AES-256 with managed keys. Encryption in transit protects data as it moves across networks between clients and servers, usually via TLS, so it cannot be intercepted or tampered with on the wire. Strong security requires both, since data is vulnerable both while it sits in storage and while it travels.