Which security control role does encryption meet?

Preventative controls act before an attack to stop it from succeeding. Encryption prevents unauthorized disclosure by rendering data unreadable without the correct key, stopping the harm at the point of access rather than detecting or responding to it afterward. This makes it a proactive, preventative measure rather than a reactive one.

Detective controls identify attacks or anomalies after or during the event (e.g., IDS, audit logs) - encryption does not detect anything.

Offensive is not a standard security control category; it describes adversarial activity, not a defensive control type.

Defensive is not a formal security control classification - the standard categories are preventative, detective, corrective, deterrent, compensating, and recovery.