Actually it means that you must be able to access memory when the server is running. Still possible, but much more difficult and requires gaining root on the s

Actually it means that you must be able to access memory when the server is running. Still possible, but much more difficult and requires gaining root on the server while it is running and has decrypted the data, or finding some RCE that allows direct access to this memory. We have numerous pen testers and code reviewers that look for and test for such things all the time. This also means evading various monitoring tools that security and network operations centers are watching. Again, still possible, but much more difficult. This also means, disks walking away are always encrypted. We physically shred all of our disks, but humans can make mistakes.