Data in transit is data actively moving from one location to another across a network (like a web request or email), making it vulnerable to interception and eavesdropping unless it's encrypted while traveling.
Data in transit is any data that's moving across a network. Think of a message leaving your laptop, traveling through routers, and landing on a server. While it's on the move, anyone who can tap that connection could potentially read it. That's the whole problem.
This matters because of how web applications work. EK 5.1.B.1 notes that some apps run on a server and you reach them through a network. Every time you log in, submit a form, or load a page, your data travels that network as data in transit. If it isn't encrypted along the way, an adversary positioned between you and the server can intercept it. The fix is encrypting the connection (which is why HTTPS exists), so even if someone grabs the data, they can't read it.
Data in transit lives in Unit 5: Securing Applications and Data, specifically topic 5.1 on application and data vulnerabilities. It connects directly to AP Cybersecurity 5.1.C, which asks you to assess risks from data vulnerabilities. EK 5.1.C.1 frames those risks around the CIA triad, and data in transit is mainly a confidentiality problem. If unencrypted data is intercepted while moving, unauthorized people gain access to sensitive information. It also ties to 5.1.B, since network-based applications are exactly what create all this moving data in the first place.
Keep studying AP Cybersecurity Unit 5
Visual cheatsheet
view galleryData at Rest and Data in Use (Unit 5)
These are the three states of data. Data at rest is sitting in storage, data in use is being actively processed in memory, and data in transit is moving across a network. Each state needs its own protection, and encryption is the common defense for transit.
Confidentiality in the CIA Triad (Unit 5)
EK 5.1.C.1 ties data risks to confidentiality, integrity, and availability. Intercepting data in transit is primarily a confidentiality breach, since an attacker reads information they shouldn't be able to see while it travels.
Web Application Attacks like SQL Injection and XSS (Unit 5)
EK 5.1.B.1 reminds you that web apps run on a server and are reached over a network. The same network traffic that carries SQL injection payloads or XSS scripts is data in transit, which is why securing the connection and validating input go hand in hand.
PII, PHI, and PCI (Unit 5)
These regulated data types raise the stakes. EK 5.1.C.2 flags highly sensitive, law-governed data as high risk, so when that kind of information is data in transit, encrypting the connection isn't optional.
Expect data in transit in multiple-choice questions that ask you to identify data states or pick the right protection. A practice stem like "Which of the following is an example of an application attack?" sits in this same topic, so you may need to reason about how data moving over a network gets exposed. On free response, you'd most likely use it when assessing risk under 5.1.C: name the vulnerability (unencrypted data moving across a network), name the CIA impact (confidentiality), and recommend a control (encrypt the connection). Know how to tell transit apart from at rest and in use, because that distinction is a clean way to be tested.
Data in transit is moving across a network right now; data at rest is stored on a drive or device and not going anywhere. EK 5.1.A.1 covers the at-rest risk, that an adversary with access to the device can read unencrypted stored files. Transit risk is different: the attacker doesn't need the device, just the ability to intercept the connection while the data travels.
Data in transit is data actively moving across a network, like a web request, login, or email in flight.
Its main risk is a confidentiality breach, since an attacker who intercepts unencrypted traffic can read it.
Encryption (such as HTTPS) is the standard defense, scrambling the data so interception doesn't reveal anything useful.
It's one of three data states alongside data at rest and data in use, and the AP exam expects you to tell them apart.
Network-based applications described in EK 5.1.B.1 are what generate data in transit, linking it to web app security overall.
It's data that's actively moving across a network, like information traveling between your device and a web server. It maps to Unit 5, topic 5.1, and matters because it can be intercepted while moving unless the connection is encrypted.
No. Data in transit is moving across a network, while data at rest is stored on a drive or device. EK 5.1.A.1 covers the at-rest danger of an adversary reading unencrypted stored files, but transit data is at risk from interception while it travels, not from someone owning the device.
Encrypt the connection so the data is unreadable while traveling. That's why HTTPS exists. Even if an attacker intercepts the traffic, encrypted data in transit gives them nothing usable.
Mainly confidentiality. EK 5.1.C.1 ties data risks to confidentiality, integrity, and availability, and intercepting moving data exposes information to unauthorized people, which is a confidentiality breach.
EK 5.1.B.1 explains that web apps run on a server and are accessed over a network. Every interaction sends your data across that network as data in transit, so without encryption an attacker positioned between you and the server can read it.
Connect this key term to the AP exam workflow: review the course, practice questions, and check related study tools.