FileVault

How it works

On Macs with Apple silicon or a T2 chip, the storage is always encrypted at the hardware level. What FileVault adds is the link between that encryption and the user's password: without FileVault, the key is available as soon as the Mac boots; with it, the key is only released once someone enters a valid password at the login window. Stolen laptop, no password, no data.

When FileVault is enabled, macOS generates a personal recovery key, a 24-character string that unlocks the disk if every password is forgotten. That key can be shown to the user once, or escrowed: encrypted with a certificate the MDM provides and sent to the MDM server, where an admin can retrieve it later.

Enabling it is a one-time operation that finishes in the background. Since macOS 10.13 and APFS, the initial encryption takes a few minutes on a new Mac rather than hours.

Why it matters for a fleet

Laptops leave the building. A 2023 study by the Ponemon Institute found that a laptop is lost or stolen in around 7% of organizations every month. Whether that's a security incident or a hardware replacement depends on one thing: was the disk encrypted, and can you prove it?

GDPR makes the distinction explicit. Article 34 of regulation 2016/679 exempts you from notifying affected individuals when the lost data was encrypted with a key the thief doesn't have. That's the difference between a quiet asset write-off and a public breach notification.

The recovery key is the operational half of the story. A Mac with FileVault on and no escrowed key is a Mac you'll wipe the day the user forgets their password. In a 300-Mac fleet, that happens more than you'd expect.

How Appaloosa handles it

Appaloosa pushes a FileVault configuration profile to managed Macs that enables encryption at the next login and requires the user to complete it before continuing. The personal recovery key is escrowed to Appaloosa automatically, encrypted in transit, and available to an authorized admin from the device page when a user is locked out.

The compliance view of your mobile device management console shows which Macs have FileVault on and which ones have a key in escrow, so an audit question like "are all laptops encrypted?" is answered with a filter rather than a survey. Macs that fall out of that state can be flagged non-compliant until encryption is turned back on.