obtaining hop information of a metadata path for backup metadata, wherein the metadata path extends from a backup server to a target storage site, and the hop information is derived in part from data zone information and includes information indicating an extent to which the backup metadata is vulnerable to attack at each hop in the metadata path;

obtaining content sensitivity information indicating a relative sensitivity of backup data to an attack;

based on the information indicating the extent to which the backup metadata is vulnerable to attack at each hop in the metadata path, an efficiency of an encrypting processing resource, a performance penalty, and the content sensitivity information, selecting an encryption to be applied to the backup metadata, wherein the performance penalty is imposed on a host by performance of the encryption by the host; and

applying, by the encrypting processing resource, the encryption to the backup metadata.