Among peers this is obvious, but it is worth saying plainly, because a lot of buying decisions turn on it. "Encrypted" on its own means almost nothing. The only question that matters is where in the stack the encryption sits, because each layer protects against the layers below it and is blind to everything above.
Run up the stack:
- Network. In transit, TLS or IPSec. Protects the data while it moves. The moment it lands, this does nothing.
- Storage. At rest on the array. Protects against a disk that walks out of the building. Anyone reaching it through the running system sees plaintext.
- VM or application. Encrypted inside the guest, or in the app itself. Now the storage team and the infrastructure beneath you only ever see ciphertext. The application, and whoever holds its keys, still see everything.
- Physical. Self-encrypting drives. Protects the drive in a skip. Protects very little while the machine is powered on.
Same word, four different threat models. Encryption at any layer protects you from what sits below it and offers nothing against what sits above. So the useful question is never "is it encrypted." It is: encrypted at which layer, and therefore against whom.
If a design answers that cleanly, it was thought about. If it cannot, the encryption is probably there to satisfy a checkbox, not a threat.