Just-in-time encryption

A method comprising:

• encrypting a plurality of files on an endpoint with a key to provide a plurality of encrypted files;
• monitoring a security state of the endpoint;
• providing the key to a process executing on the endpoint whenever the security state of the endpoint is not compromised and revoking the key from the process whenever the security state of the endpoint is compromised;
• detecting an access to a new file other than one of the plurality of encrypted files by the process;
• and
• if the security state of the endpoint is not compromised, encrypting the new file with the key immediately upon access by the process to add the new file to the plurality of encrypted files.

A system comprising:

• an endpoint;
• a first memory on the endpoint storing a key;
• a second memory on the endpoint storing a plurality of files encrypted by the key;
• a process executing on a processor on the endpoint;
• and
• a security agent executing on the processor, the security agent configured to monitor a security state of the endpoint and to detect a potential security compromise of the endpoint, wherein the processor is configured to detect an access to a new file other than one of the plurality of files, and if the security state of the endpoint is not compromised, to encrypt the new file with the key immediately upon access by the process to add the new file to the plurality of files encrypted by the key.