It is extremely easy for any generalist software developer to use “AES-256” encryption in an application incorrectly and to produce a completely insecure system. Worse still, the developer may be completely unaware of the flaws in his/her system. One of the easiest examples to understand is when a developer uses the wrong mode of encryption – as shown in the diagram below.

Although this is a very basic mistake that hopefully will never be replicated in real-life applications, there are many other subtle mistakes that a developer can make that results in an insecure system.