Security frameworks and compliance checklists treat data protection as two root problems: protect data when it is stored, and protect data when it moves. Encrypt the disk. Encrypt the channel. Check both boxes and move on.
But data has a third state - and that is where most major breaches actually happen.
Three States of Data
Files on disk, backups, and storage devices when not in motion.
✓ Covered by 800-171Moving across networks, between systems, or between users.
✓ Covered by 800-171Actively processed, held in memory, being queried or transformed.
⚠ The Unaddressed GapThree States, Two Solutions
Data at rest is data sitting on a disk, drive, backup, or storage device. Encryption at rest protects it when the device is powered off, stolen, lost, or physically accessed without authorization. This is a necessary control.
Data in transit is data moving between systems, applications, or users. TLS and encrypted channels protect it as it travels. Also necessary.
Data in use is data being actively processed - loaded into memory, queried from a database, handled by an application, or moved through a file-transfer platform. This is the data-in-use state most organizations leave unaddressed.
Once a system is running and authorized to process data, the data must be decrypted and readable for the system to do its job. At that stage, encryption at rest and encryption in transit have already served their purpose. What protects the data now is a different set of controls: access management, network segmentation, patching, monitoring and other safeguards that reduce the likelihood of compromise but do not eliminate the exposure if a compromise occurs.
This is not necessarily an oversight of one organization’s security program. It is a structural limitation in how most systems operate: data can be protected at rest and in transit, but it still has to be decrypted at the point of use.
What NIST SP 800-171 Covers
NIST SP 800-171 requires organizations handling Controlled Unclassified Information (CUI) to protect it at rest and in transit (NIST SP 800-171r3, Section 3.13.8): “Transmission and Storage Confidentiality: Implement cryptographic mechanisms to prevent the unauthorized disclosure of CUI during transmission and while in storage.”
This control covers data that is stored and data that is moving. What is not covered is actively processing data in a live system. That is the window between “data arrives encrypted” and “data leaves encrypted again.” During that window, the data must be readable for the system to function, and anyone who has compromised the live system may be able to reach it.
An organization can satisfy every NIST SP 800-171 and CMMC Level 2 control and still face this exposure. The controls reduce risk, but they do not eliminate the value of a live system as an attack target.
"An organization can satisfy every NIST SP 800-171 and CMMC Level 2 control and still have a live system whose compromise yields readable data. The controls reduce risk. They do not close the structural gap."
Three Breaches, One Pattern
Between 2021 and 2023, three large-scale breaches demonstrated what this gap looks like in practice. All three targeted managed file transfer platforms - systems that sit at the center of organizational data flows, trusted by IT teams, connected to partners, and exposed to the internet.
Attackers exploited multiple zero-day vulnerabilities, deployed a web shell, and exfiltrated sensitive files from over 100 organizations - including banks, law firms, universities, government agencies, and healthcare institutions.
A pre-authentication remote code execution vulnerabilit - requiring no credentials - compromised over 130 customer environments, simultaneously exposing payroll files, customer records, financial reports, and healthcare data across multiple organizations.
SQL injection allowed attackers to deploy a web shell, access underlying databases, and steal data from an estimated 2,700 organizations affecting approximately 93 million people. Exposed records included HR files, payroll data, government records, and financial information.
Largest managed file transfer breach on record.
All three attacks followed the same model: exploit a vulnerability in a live internet-facing system, reach the data that system is already authorized to handle in readable form, and exfiltrate it.
The Structural Problem
Patching the specific vulnerabilities in Accellion, GoAnywhere, and MOVEit was the correct response. But patching addresses the known vulnerability, not the underlying condition that made each system a valuable target.
Managed file transfer platforms, and many other data-handling systems, concentrate sensitive data from multiple sources, operate continuously online, and must process data in readable form to function. That combination creates persistent target value regardless of which specific vulnerability an attacker exploits next.
Closing the vulnerability addresses the immediate risk. The more strategic challenge is reducing the value of a compromise: if an attacker gets in, how much data is actually compromised?
Protecting Data in Use
The answer requires rethinking what “data protection” means for live systems.
The goal is not to prevent all intrusions - that is not achievable. The goal is to ensure that a successful intrusion does not automatically yield usable data.
This requires a different model: one where data is decrypted only for the specific authorized user or trusted execution environment that needs it, under keys that the infrastructure operator does not hold. Decryption keys are made available only within the authorized execution context for which they are intended and are never maintained as a centralized repository accessible to administrators or infrastructure services. If the server infrastructure is compromised, the attacker reaches encrypted data rather than readable files.
This is the problem tiCrypt is built to address.
In tiCrypt, each authorized user possesses their own private key, which remains under the user’s control and is never stored on servers. Data can be encrypted for individual users, allowing only those users to decrypt and access the information. Because the private key never leaves the user’s control, neither administrators nor attackers can decrypt it - regardless of their level of infrastructure access.
When computation must be performed, secure virtual machines establish encrypted communication channels using ephemeral session keys derived from the Diffie-Hellman exchange. The virtual machines communicate exclusively through these encrypted channels and do not maintain a centralized repository of user decryption keys. User keys are available only within the authorized execution environment that the user has established and remain inaccessible to the surrounding infrastructure. Data therefore remains protected as it moves between users, storage systems, and processing environments.
As a result, compromising infrastructure does not automatically provide access to readable data. An attacker who gains administrative access to servers, storage systems, hypervisors, or management services encounters encrypted information and encrypted communications rather than a centralized repository of decryption keys. The compromise of infrastructure therefore does not automatically become a compromise of data.
The practical effect is significant. When the stolen data remains encrypted and the keys are unavailable to the attacker, no sensitive information is exposed.
"When private keys never leave the user and never reside on servers, infrastructure compromise does not become data compromise. The attacker inherits only encrypted data and encrypted communications - regardless of their level of access."
Completing the Picture
Encryption at rest protects stored data from physical access and offline attacks. Encryption in transit protects data moving between systems.
Encryption in use protects data while it is actively being processed, but it remains an area that many organizations and compliance frameworks have not yet fully addressed.
The Accellion, GoAnywhere, and MOVEit breaches are demonstrations of a repeatable attack model against a structural gap. As long as sensitive data becomes fully readable on live servers that are reachable from the internet, the gap remains.
The conversation in security and compliance needs to move beyond the first two data states and take the third one seriously.
Explore the end-to-end encrypted architecture, key management model, and how tiCrypt protects CUI throughout its entire lifecycle.