The Aegis Secure Key 3 does its encryption in hardware. Real-time 256-bit AES-XTS runs on the device itself, and you unlock it with a PIN entered on the drive's own on-board keypad. Nothing is typed on the computer, and there is no software, app or driver to install. That makes it independent of the operating system, so it behaves the same on a machine you manage and one you have never seen before.
Because the PIN is entered on the drive and never reaches the host, a keylogger or screen grabber on the computer has nothing to capture. Get the PIN wrong too many times and the drive's brute-force defence wipes the encryption key, which leaves the data genuinely unrecoverable rather than simply locked away. The Aegis line is FIPS 140-2 Level 3 validated, the assurance benchmark most government and regulated buyers are told to look for.
For issuing drives to other people, you can set a separate admin PIN alongside the user's, force enrolment so the recipient sets their own PIN on first use, and switch the drive to read-only when you only need someone to read from it. That gives an administrator a degree of control without any host-side agent.
The headline is the capacity. Two terabytes of hardware-encrypted storage sits in a device small enough to share a keyring, with a plain USB-A connector and no setup on arrival. It is built for carrying large, sensitive data sets in a pocket rather than posting a laptop or a stack of disks.
Our take: this suits regulated work, incident response, and anyone who moves big data across machines they do not control. It is not a managed fleet tool. There is no central console, remote wipe or audit log, so if you need policy and reporting across many users, look at endpoint encryption instead.
