Encryption in transit
In data security, encryption in transit protects data as it travels across a network, usually with TLS, so it cannot be read or altered in flight. It is one arm of the encryption story, sitting alongside encryption at rest and encryption in use, and each protects data in a different state, which is why they are not interchangeable.
How it works
Encryption in transit wraps data in a secure channel while it moves between two points: browser to server, service to service, client to API. In practice this almost always means TLS, which encrypts the payload, authenticates the endpoints through certificates, and detects tampering. For internal or high-value links it can be strengthened to mutual TLS, where both ends present certificates, and even a DNS lookup can be protected with DNS over HTTPS. It is distinct from encryption at rest, which protects stored data, and from encryption in use, which protects data while it is being processed. Together they cover the three states data exists in, and a gap in any one leaves a window.
What goes wrong
The failure is a channel that is encrypted at the edge and clear inside. An organisation terminates TLS at a load balancer and then sends the traffic onward to internal services in plain text, assuming the internal network is safe, which it is not once an attacker has any foothold. Other recurring gaps are service-to-service calls left unencrypted for convenience, and endpoints that offer a weak TLS configuration alongside a strong one. From the attacker’s seat, the value is a link that carries credentials or sensitive data in the clear at some hop, so a position on the internal network yields the data without breaking any cryptography at all.
Where this shows up in an audit
We verify protection in transit end to end, not just at the front door: which hops are encrypted, whether internal service-to-service traffic is protected, and whether the endpoints negotiate strong parameters. We flag any leg that carries sensitive data in the clear, with the exposure demonstrated where scope allows, and we note where forward secrecy or migration towards post-quantum cryptography is relevant for long-lived confidentiality. The finding is written against the unprotected hop. This is part of how we verify data is protected in transit.