Which security control role does encryption meet?

Preventative controls act before an incident occurs to block or reduce the impact of an attack. Encryption renders data unreadable to unauthorized users, preventing disclosure even if data is intercepted or stolen. This stops the harmful outcome proactively rather than detecting or responding to it afterward.

Detective controls identify incidents after or during occurrence, such as IDS alerts or audit logs; encryption does not detect attacks.

Offensive is not a standard security control classification; it describes active attack techniques, not defensive measures.

Defensive is an informal broad term, not a recognized control category; the correct formal category for encryption is preventative.