I don't think this answer is fair. If the encryption is deployed to ensure that only a subset of systems that process or transmit sensitive information can unde

I don't think this answer is fair. If the encryption is deployed to ensure that only a subset of systems that process or transmit sensitive information can understand it, the attack surface that results in disclosure of the information has been reduced. Elsewhere in this thread you said that a compromise of a database is likely associated with a compromise of systems that access that database, but this is not necessary true if the platforms and administration of these systems are very heterogeneous (say, different operating systems), and in any case it doesn't make it not an application of defense in depth. (Suppose that 90% of attacks that penetrate the database also penetrate the client; now this use of encryption has managed to beneficially mitigate 10% of these attacks.)