Sophos SafeGuard Enterprise

checks each managed endpoint against the encryption policy and flags machines whose disks are not fully encrypted, so gaps are visible from one console rather than device by device

applies the removable-media policy at the point of write, encrypting or blocking data copied to unmanaged sticks and drives depending on what the policy allows

shows whether that specific machine's disk was reporting as encrypted and compliant at last check-in, letting the incident be closed as low-risk instead of assumed as a breach

manages keys centrally and lets an administrator recover access to encrypted data for a user who is locked out or has left, instead of the data being unrecoverable

extends the same policy-driven encryption to files synced into cloud storage locations, so protection follows the file rather than stopping at the endpoint

reports policy status per endpoint from the central console, so machines still running an older or unapplied policy show up as out of compliance