2 of 18 encryption tools protect a file after it leaves; disk encryption is free

01The disk is solved; the recovery key is not

BitLocker is licensed with Windows Pro, Enterprise and Education. On qualifying hardware, Windows turns on “device encryption” by itself after setup, using XTS-AES with a 128-bit key, and backs the recovery key up to Entra ID, Active Directory or the user’s Microsoft account.² Android has not allowed full-disk encryption on new devices since Android 10 and requires file-based encryption instead.³ Apple builds Data Protection into iPhone, iPad and Mac.⁴ On the server side, Amazon S3 has applied server-side encryption to every new object at no additional cost since 5 January 2023.⁵

The catch is in Microsoft’s own documentation. A Windows PC that uses only local accounts “remains unprotected even though the data is encrypted”, because no recovery key was ever escrowed and the protector is never sealed.² That is the realistic state of a small office’s laptops: encrypted on paper, with no one able to say where the keys are. NIST, for its part, does not expect symmetric algorithms such as AES to need replacing in the post-quantum transition.⁷ The disk is the solved part.

02What the 18 products in our guide actually do

TechBag’s Encryption & Rights Management guide lists 18 products from nine vendors: Thales, Entrust, HashiCorp, ESET, Trellix, Seqrite, Seclore, Microsoft and Forcepoint.¹ Sorted by what each one does rather than what its datasheet is called, they split three ways.

The classification tools are where money is most often wasted. A label on a document is metadata; it does something only when a DLP engine or a rights-management server reads it. Bought alone, it produces a tidy taxonomy that nothing enforces. Rights management is the opposite case: the only control on the list that still works after a file has gone to an auditor, a distributor or a design partner, because the policy sits inside the file and the recipient’s copy can be revoked. If files do not leave your organisation, you do not need it. If they do, nothing else in the 18 answers the question.

The most under-bought line in the “encryption and key custody” group is secrets management: somewhere other than the code to keep API keys, database passwords and certificates, with rotation and an audit trail. It is also the cheapest place to start. HashiCorp Vault’s Community edition is free and self-hostable, with the managed and Enterprise editions quoted; Thales sells the same job as CipherTrust Secrets Management, licensed by the applications that call it rather than by data volume.¹ An encrypted database whose password sits in a configuration file in the repository is encrypted in name only.

03Keys cost a dollar a month in the cloud and a capital budget on premises

The cloud providers publish the price of key custody, and it is small. AWS KMS charges US$1 a month for each customer-managed key, plus US$1 a month for each of the first two rotations, after which rotation is free.⁶ Google Cloud KMS bills by the hour; at 730 hours a month a software key costs about six cents and a key held in Google’s HSMs US$1 to US$2.50, plus US$0.03 per 10,000 operations, the same rate AWS uses in its own worked example.⁸

A dedicated HSM is a different order of cost. AWS’s own worked example prices a CloudHSM at US$1.60 an hour, which is about US$1,168 a month for one unit, and a production deployment wants two.⁶ On premises, the two hardware HSMs on TechBag’s guide, Thales Luna and Entrust nShield, are quote-only capital purchases: an appliance plus a support contract, and a second unit if you want to survive the first failing.¹

04The deadline is 2030, and it is about RSA, not AES

NIST published its first three post-quantum standards on 13 August 2024: ML-KEM for establishing keys and ML-DSA and SLH-DSA for signatures, and urged administrators to start integrating them immediately.⁹ Its transition plan, still in draft as of September 2026, sets the dates for retiring what they replace.⁷ Laid out on a calendar, the shape is plain: both 2024 milestones are publications, and the first date that changes what an RSA key may be used for is after 2030.

Two things in the draft matter to a buyer in India. First, the risk is not evenly spread: NIST names “harvest now, decrypt later” as the threat to key establishment in TLS and to encrypted email, because traffic captured today can be read once a large enough quantum computer exists.⁷ Data that must stay confidential for ten years, such as health records, Aadhaar-linked files or a design drawing, is the data to move first. Second, the draft says HSMs and TPMs will need firmware or hardware revised to support the new algorithms.⁷ An HSM bought this year should come with a written answer on ML-KEM and ML-DSA support.