databases

Most database breaches are not clever. They are a reachable database, an over-privileged account, a leaked credential or an exposed backup.

The same injection bug can leak one table or hand over the server. The difference is decided by grants made long before the bug was written.

Managed databases remove patching chores but add a control plane: whoever can call the cloud API can often copy, share or expose the whole database.

These breaches rarely involved exploits. Databases built for trusted networks were put on the internet with no password, and automated scripts found them within hours.

Every database encryption option protects against someone. The question is whether it protects against the attacker you are worried about, and most only stop thieves of disks and backups.