Data at Rest vs. Data in Motion: Where Leaks Actually Happen

The same file lives in three conditions over a single day. It sits in a database overnight. It travels across the network when someone emails it. It sits open on a screen when someone copies a column or pastes it into a chatbot. Security teams call these data at rest, data in motion, and data in use. Each leaks in its own way, and the newest gap, the one most tools miss, is the moment data gets used.

What Is Data at Rest?

Data at rest is any data that's stored and not moving: files on a disk, rows in a database, objects in a cloud bucket, documents on a laptop. It's the largest, most static category, which is why it's the classic target for encryption and the first thing a stolen laptop exposes.

Examples are everywhere: a customer database, an archived email store, a backup snapshot in Amazon S3. If it's saved and nobody's touching it right now, it's at rest. It's the state security programs know best, after decades of storage encryption and access control.

What Is Data in Motion?

Data in motion, also called data in transit, is data moving from one place to another: an email in flight, a file uploading to the cloud, an API call between services. It's exposed while it travels, so the standard protection is encryption in transit, usually TLS, so anyone intercepting it sees noise.

Motion is where classic data loss prevention (DLP) tools spend their attention: scanning email, blocking uploads, watching network egress. That coverage was built for a world where data moved between known systems over channels a firewall could see. Newer movement, into browser-based AI tools and personal SaaS accounts, slips past it.

What Is Data in Use?

Data in use is data that's active: open in an app, loaded in memory, displayed on a screen, being copied or pasted. It's the hardest state to protect because the data has to be readable to be useful. Encryption is off at this point, and the only real signal is what the person does with it.

Most guides mention this state and then hurry past it, framing it as a memory-encryption or confidential-computing problem. The practical version is simpler and far more common: someone with legitimate access opens a file and moves part of it somewhere it shouldn't go. That somewhere, more and more often, is an AI tool.

Data at Rest vs. Data in Motion: What's the Difference?

The difference comes down to whether the data is still or moving. Data at rest sits in storage behind encryption and access control. Data in motion travels between systems behind encryption in transit. Data in use is active and can't be encrypted while it's worked with, so it's watched for behavior and intent instead.

Read across the table and the pattern shows up. Rest and motion have mature, well-understood defenses. Use is the column where they thin out, and the one growing fastest, because so much daily work now runs through tools that read and generate text.

How Each Data State Is Protected

Each state has a standard defense. Data at rest is encrypted with AES-256, so a stolen disk is useless without the keys. Data in motion is encrypted in transit with TLS. Data in use can't be locked the same way, so it's guarded by access controls and monitoring that reads intent.

Encryption does the heavy lifting for the first two states, and AES-256 at rest plus TLS in transit is close to table stakes. The limit is worth sitting with: encryption keeps outsiders out, but it can't tell whether a legitimate insider should be moving or using the data at all. Someone with valid access and a valid key can still paste a customer list into the wrong place. That's the gap the next section is about.

Data in Use Is the AI-Era Blind Spot

Data in use is the state the AI era broke wide open. When an employee pastes a customer list into ChatGPT or a config file into Copilot, that data leaves the company over a channel no firewall records and no email filter inspects. It looks like normal work, which is why tools built for rest and motion miss it.

This is where pattern-matching against fixed rules runs out of room. A rule that looks for a credit-card number says nothing about whether pasting a spreadsheet into a chatbot is routine or a serious exposure. Answering that takes two things at once: watching how the data moves, and reading the intent behind the action as it happens.

ORION Security was built for that moment. Instead of static rules, it classifies data with AI and watches where it goes, including into AI tools, so a paste into ChatGPT or Copilot is as visible as an email attachment always was. It also reads identity and environment, so an employee on a personal AI account looks different from the same person on a sanctioned corporate one. The output is a verdict on what happened, not another alert to triage.

The visibility catches people off guard. One aviation customer switched this monitoring on and saw a passenger record sitting inside an AI assistant, where an employee had pasted it to get work done, something no prior tool had ever shown. Nobody stole it and no attacker was involved; it slipped out in the middle of an ordinary task, and nobody in security had seen it. The data most likely to leak is the data in use, on a screen or in a prompt box, and a session shows that moment on your own environment.

Frequently Asked Questions

Is AES-256 used for data at rest?

Yes. AES-256 is the most common standard for encrypting data at rest, strong enough that a stolen disk is useless without the keys. But encryption at rest only protects data from outsiders. It can't stop a legitimate user from pasting that data somewhere it shouldn't go.

What is the difference between data in motion and data in transit?

They're the same thing. Data in motion and data in transit both describe data moving across a network, from an email in flight to a file uploading to the cloud. Vendors differ on which term they use, but both point to the same state and the same protection: encryption in transit.

Which data state is the hardest to protect?

Data in use. Once information is open on a screen or pasted into a tool, encryption is off and the only signal left is intent. That's why data in use is the state most tools skip, and where AI-era leaks now cluster.

Can encryption stop data from leaking?

Only partly. Encryption protects data at rest and in motion from outsiders, but it can't tell whether a legitimate user should be moving the data at all. Stopping the leaks that start with normal work means watching data movement and reading intent, not only scrambling the bytes.