Encryption
Turn readable data into ciphertext with an algorithm and a key. The keys are the asset. A key taped to the data is theatre.
Encryption turns plaintext into ciphertext so confidentiality holds at rest or in transit. Decryption is the reverse, and it needs the key. If everyone with the VM can unwrap it, you have stolen-laptop protection, not hypervisor protection.
In transit: modern TLS, certificates you rotate, mTLS where service-to-service trust matters. At rest: volume encryption as a floor; application-level encryption when the host is not trusted; separate key management.
End-to-end encryption means only the communicating ends can read the payload. A VPN that decrypts at a middle box is not that.
Fact source: ASD's ACSC glossary. Wording is Cyberstack's.