Hardware vs. Software Encryption: Which Should Your Business Use?

Encryption is the control that turns a lost laptop into an inconvenience rather than a reportable breach. Most state breach laws, including Minnesota’s, exempt data that was encrypted, HIPAA treats encrypted data the same way, and every cyber-insurance application now asks whether laptops and portable media are encrypted. The question businesses actually ask us is which kind: hardware or software. In 2026 the honest answer is that the method matters less than the management, and this article explains why. It covers what hardware and software encryption each mean, what BitLocker, FileVault, TPM chips and self-encrypting drives do, where each belongs, and what we set up for clients.

What the two terms mean

Software encryption is done by the operating system or an application using the computer’s processor. BitLocker on Windows, FileVault on macOS, LUKS on Linux and tools such as VeraCrypt are software encryption. The key is protected by your sign-in, and on modern machines it is sealed inside a security chip so the disk cannot be read in another computer.

Hardware encryption is done by a chip on the storage device itself. Self-encrypting SSDs following the Opal standard encrypt everything written to them, always, and unlock with a password or a key handed over by the operating system. Hardware-encrypted USB drives from makers such as Kingston and Apricorn do the same in a stick, with a keypad or a password app, and the best of them carry a FIPS 140-3 validation.

The TPM chip in every Windows 11 computer confuses the picture. It is hardware, but it does not encrypt the disk; it holds and protects the keys that software encryption uses, and it refuses to release them if the machine has been tampered with. TPM-backed BitLocker is software encryption with hardware-protected keys, and it is the arrangement almost every business laptop should be in.

Hardware vs. software, honestly compared

What we set up for clients

Laptops and desktops: BitLocker on Windows 11 Pro, backed by the TPM, enforced by Intune with the recovery key escrowed to Microsoft Entra ID automatically, and a compliance report that shows any machine that is not encrypted. FileVault on Macs, with the recovery key escrowed through device management the same way. Since Windows 11 24H2, new installations turn on device encryption by default when the person signs in with a work or Microsoft account, which is welcome but not a substitute for enforcing it and holding the keys. For machines that carry especially sensitive data, a pre-boot PIN adds protection against attacks on a sleeping laptop.

USB drives and portable media: hardware-encrypted drives with a FIPS validation, or a policy that blocks unencrypted removable media altogether, which Intune can enforce. Most of our clients choose the second, because the honest answer to “why does this need to be on a USB stick” is usually that it does not; SharePoint and OneDrive with the right sharing settings replace the stick.

Servers: BitLocker on the volumes, which protects against a stolen or improperly disposed drive, plus application-level encryption where a database supports it. For servers in our colocation facility the physical controls do most of the work, and encryption covers the drive that leaves for replacement.

Phones and tablets: encrypted by default on iOS and Android; the control is a passcode requirement and remote wipe, enforced through device management.

Key management is the actual job

Encryption without key management is a data-loss plan. The recovery key for every encrypted device must be stored somewhere an administrator can retrieve it, automatically, before the device is ever handed to a person. That is what Entra ID, Intune and Active Directory escrow do, and it is what the licence in Microsoft 365 Business Premium provides; our guide to what Business Premium includes lists the tools. The second half of the job is proof: a report that says every device is encrypted and compliant, which is what an insurer, an auditor or a client’s vendor questionnaire will ask for. The cyber insurance readiness check shows the question as insurers phrase it.

Compliance notes

HIPAA does not strictly require encryption but treats it as the addressable safeguard that makes a lost device a non-breach; our HIPAA security checklist covers the rest of the Security Rule. PCI DSS requires strong cryptography for stored card data. CMMC and NIST 800-171 require FIPS-validated encryption for controlled unclassified information, which is where the choice of product starts to matter; BitLocker can be run in FIPS mode and validated USB drives exist for this reason. The CMMC Level 1 self-check is the starting point for defence contractors.

What encryption does not do

Encryption protects data on a device that is off or locked. It does nothing against ransomware, which runs on a signed-in computer, against a phishing attack, or against an attacker who logs in with a stolen password. Those are the jobs of endpoint detection, multi-factor authentication and backups, described in our article on firewalls, antivirus and EDR. Encryption is one layer, cheap and now mostly automatic, and the reason to get it right is that the day it matters is the day a laptop is left in a taxi.

Common questions

Is BitLocker enough?

For laptops and desktops, yes, provided it is managed: turned on everywhere, backed by the TPM chip, with recovery keys stored centrally in Microsoft Entra ID or Intune and a report showing which machines are compliant. BitLocker on one computer with the recovery key on a sticky note is not a control.

Does encryption slow down the computer?

Not noticeably on anything made in the last decade. Modern processors have dedicated instructions for the AES cipher that BitLocker and FileVault use, and the overhead is a few percent at most. Hardware-encrypting drives have no overhead at all, which used to be the argument for them.

What happens if we lose the recovery key?

The data is gone. That is the point of encryption and the reason key management is the whole job. Managed computers escrow their recovery keys automatically to Entra ID, Intune or Active Directory, where an administrator can retrieve them; unmanaged ones must have the key saved somewhere safe before anything goes wrong.

Do office desktops need encryption too?

Yes. Desktops are stolen in burglaries and disposed of with data on them, and cyber-insurance and compliance questionnaires ask about all computers, not only laptops. Since Windows 11 24H2 enables device encryption by default on new installations, most new machines start encrypted anyway.

Is our data in Microsoft 365 encrypted?

Yes, at rest and in transit, by Microsoft, with keys Microsoft manages unless you pay for customer-managed keys. What the platform does not encrypt is the copy on each laptop, which is why device encryption still matters.

Does encryption protect against ransomware?

No. Ransomware runs on a computer that is already unlocked, so it reads and encrypts your files the same way you do. Encryption protects data on a lost or stolen device; endpoint detection and backups protect against ransomware.

Talk to us

If you are not sure every laptop your business owns is encrypted, or where the recovery keys are, we will check and give you a report. Call 952-548-5558 or contact us; the first conversation is free and there is no long-term contract.