Today is Global Encryption Day, and the most useful thing we can contribute is a straightforward observation from the field: encryption is one of the most consistently misconfigured controls we assess.
The intention is almost always correct. Organisations know encryption matters. The gap tends to be in execution. TLS 1.0 and 1.1 still present on services that were supposed to have been hardened. Cipher suites that support known-weak algorithms left enabled by default. Certificates that have lapsed without anyone noticing. Internal traffic that travels unencrypted because it never left the network, until it did.
Encryption done properly is a serious control. Encryption deployed carelessly gives a false sense of security that can be harder to identify than having no encryption at all. If your encryption posture hasn't been independently assessed as part of a structured infrastructure review, today is a reasonable prompt to put it on the list.