For years, the open lakehouse had an honest gap that practitioners whispered about and slide decks skipped: encryption. Not the checkbox kind, every cloud bucket has offered that for a decade, but the real kind, where the data itself is cryptographically protected in a way that survives a compromised bucket, satisfies a regulator, and still works when five different query engines from five different vendors need to read the same table. That last clause is the hard part, and it is why encryption arrived at the lakehouse years after transactions, evolution, and time travel.
The gap is now closing, and 2026 is the year it became real. Apache Parquet's modular encryption matured from specification into broadly implemented capability, and Apache Iceberg 1.11, released this May, shipped table-level encryption as a headline feature: a full envelope-encryption design with a three-tier key hierarchy, encrypted metadata, and the catalog as the key broker. The pieces of an interoperable encrypted lakehouse finally exist. What does not yet exist is widespread understanding of how they fit, and encryption is a domain where partial understanding is worse than none, because a misconfigured cryptosystem produces perfect confidence and no protection.
