Indeed. I'm about to have a form of that conversation with a client today. Just encrypting columns in your database is of some value, but having the symmetric k

Indeed. I'm about to have a form of that conversation with a client today. Just encrypting columns in your database is of some value, but having the symmetric key in an environment variable (a common practice) is not going to prevent a breach when the data and the key are compromised at the same time.