I wonder if OP works in healthcare, after HIPAA passed encryption at rest was the buzz word of the decade as it was one of the primary requirement of HIPAA.

The problem of course being, most health care breaches are on applications that aren't at rest so all the data was being stolen anyway.

From 2012-2021 I worked in health tech and on many calls with large customers and security questionnaires were on whether we were actually storing their data encrypted at rest. We even had to get audited for Aetna to validate encryption at rest (amongst other things). To me this seemed like such a joke of a requirement because all our data was in AWS, and breaches were far more likely from other avenues.

So to me this reads as a jaded SWE or CISSP who has dealt with how much attention this one attack vector is paid, but ultimately it is kind of a given now in modern cloud infra.