TDE encrypts data files at rest, ensuring that even if the storage medium is compromised, the data remains unreadable.