Encryption at rest is not enough to counter credential theft in production, because when malicious code can read an application's production credentials, encrypted storage does not prevent their misuse.