End-to-end encryption secures the content of communications between two endpoints, but does not cover the underlying network infrastructure. Metadata, routing information, and the physical transmission layer remain visible and vulnerable to attackers who have access to the network itself. For organizations with strict security requirements, end-to-end encryption is therefore a necessary but insufficient measure.
Which security layers does end-to-end encryption not cover?
End-to-end encryption protects the content of messages or data streams between sender and receiver, but leaves the underlying transport layers unprotected. Traffic metadata, such as source and destination addresses, timestamps, and traffic patterns, remains readable. Physical transmission over fiber optic or copper also falls outside the scope of end-to-end encryption.
Concretely, this means that an attacker with access to a network node or a fiber optic connection can eavesdrop at layer 1 (physical) or layer 2 (data link layer) of the OSI model, without having to decrypt the encrypted payload. Traffic analysis alone can reveal sensitive information: who communicates with whom, how often, and how much data is exchanged. For business-critical environments, this is a serious risk that end-to-end encryption does not solve.
What is the difference between layer 1, layer 2, and end-to-end encryption?
The difference lies in the level of the OSI model at which the encryption takes place. Layer 1 encryption secures the raw bitstream on the physical transmission medium. Layer 2 encryption encrypts data packets at the data link layer level, before routing information is added. End-to-end encryption operates at the application level and protects only the content of communications between two endpoints.
Layer 1 encryption: security at the physical medium
Layer 1 encryption encrypts the signal directly at the transmission layer, for example on a fiber optic connection. Even if an attacker physically taps the medium, they receive only unreadable data. This is the most fundamental form of network security and offers protection that no higher-level protocol can provide.
Layer 2 encryption: security at the data link layer
Layer 2 encryption operates at the level of Ethernet frames and encrypts traffic before it enters the network. This means that both the content and most metadata are protected against eavesdropping within the network segment. This makes layer 2 encryption particularly effective in WAN environments and for connections between data centers, where traffic runs over shared infrastructure.
When is additional encryption at the network level mandatory?
Additional encryption at the network level is mandatory when laws and regulations explicitly require it, or when an organization’s risk analysis shows that end-to-end encryption provides insufficient protection. Think of sectors such as defense, healthcare, finance, and critical infrastructure, where both the content and the metadata of communications must remain strictly confidential.
In practice, frameworks such as the NIS2 directive, BIO (Baseline Information Security Government), and sector-specific regulations require organizations to implement appropriate technical measures for data-in-transit security. This goes beyond end-to-end encryption alone. When sensitive data is transported over shared or public network infrastructure, encryption at layer 1 or layer 2 is often not only recommended but required.
How does layer 2 encryption protect where end-to-end encryption falls short?
Layer 2 encryption fills the blind spots of end-to-end encryption by encrypting the entire Ethernet frame, including header information that remains visible with end-to-end encryption. This makes traffic analysis by malicious actors at the network level impossible, because routing information and metadata are also protected.
A practical example: with a connection between two branches over a leased WAN circuit, the content of application traffic is encrypted via end-to-end encryption, but an attacker on the WAN segment can still see how much traffic is flowing and between which locations. Layer 2 encryption closes this gap completely. Our encryption solutions are specifically designed to provide this protection at the level where end-to-end encryption stops.
Which sectors face the greatest risk without network-level encryption?
Sectors that work with highly sensitive data or business-critical infrastructure face the greatest risk when network-level encryption is absent. These are primarily the healthcare sector, government and defense, financial institutions, energy companies, and operators of critical infrastructure such as transport and utilities.
In the healthcare sector, patient data is strictly confidential, and even traffic patterns can reveal information about treatments or diagnoses. In energy and transport networks, insight into communication patterns can be used to prepare attacks on operational technology. Maritime environments present a particular challenge: communication over satellite or radio is inherently vulnerable to interception, making encryption at multiple layers necessary. Data centers that provide connections to multiple customers must also guarantee that traffic from one customer is not visible to another, even at the metadata level.
Want to know how to adequately secure your specific environment? Then view our overview of security solutions for various sectors.
How do you combine end-to-end encryption with quantum-safe network security?
The combination of end-to-end encryption and quantum-safe network security offers the most robust protection against both current and future threats. End-to-end encryption protects the content of communications at the application level, while quantum-safe encryption at layer 1 or layer 2 secures the underlying transmission against attacks by quantum computers.
Quantum computers pose a growing threat to classical encryption algorithms. The approach already being deployed is called “harvest now, decrypt later”: attackers intercept encrypted traffic today and store it until quantum computers are powerful enough to break the encryption. This makes it urgent to switch to post-quantum algorithms now, including at the network level.
Quantum-safe security at layer 1 and layer 2 ensures that even intercepted traffic remains unreadable, regardless of the computing power of future systems. By combining this with end-to-end encryption at the application level, a layered defense is created in which no single layer forms a weak link. More information on how to prepare your organization for this threat can be found on our page about protection against quantum threats.
A layered security architecture requires careful alignment of solutions with the specific network environment. We help organizations design an approach that seamlessly integrates end-to-end encryption and network-level security, tailored to the risk profiles and compliance requirements that apply to your sector.
Ready for the next step?
View our solutions or contact one of our experts directly.
