Design decisions that decide how bad an incident gets.
A hardware security key proves your presence with a physical FIDO2 device no phisher can clone — buy two, register both, and phishing on your key-protected accounts is effectively finished.
End-to-end encryption locks a message so only the recipients' devices can read it — but many services that look encrypted actually keep a key, and knowing the difference decides who can hand your data over.
Full-disk encryption scrambles everything on a laptop — modern Macs and Windows machines can turn it on in minutes, and the only critical step is backing up the recovery key.