Exos security-model guide
Seagate Exos Standard vs SED vs ISE: Security Models Explained
Exos security labels are not interchangeable. A base or ISE-capable model, a self-encrypting drive and a FIPS-validated SED can share the same capacity and generation while using different exact model numbers. The buyer must match the security requirement to the host software and controller rather than assuming every Exos drive provides managed locking or compliance certification.
Buy the least complex exact security variant that meets a defined requirement
For ordinary NAS and home-server storage, a standard or ISE-capable exact model is usually sufficient when operating-system encryption handles confidentiality. Choose an SED when the system can manage TCG Enterprise security and drive locking. Choose an SED-FIPS model only when a compliance program specifically requires that validated cryptographic module and the complete host environment supports it.
Interactive decision tool
Standard, ISE, SED or FIPS selector
Exact-model reference
Do not buy from the family name alone
Use the complete model number to confirm generation, interface, sector format and security class. Similar capacities can belong to different interfaces and security variants.
| Exact model | Generation | Capacity | Interface | Sector format | Security |
|---|---|---|---|---|---|
| ST12000NM002H | Exos X24 | 12TB | SATA | 512e / 4Kn FastFormat | ISE |
| ST12000NM001H | Exos X24 | 12TB | SATA | 512e / 4Kn FastFormat | SED |
| ST16000NM002H | Exos X24 | 16TB | SATA | 512e / 4Kn FastFormat | ISE |
| ST16000NM001H | Exos X24 | 16TB | SATA | 512e / 4Kn FastFormat | SED |
| ST20000NM002H | Exos X24 | 20TB | SATA | 512e / 4Kn FastFormat | ISE |
| ST20000NM001H | Exos X24 | 20TB | SATA | 512e / 4Kn FastFormat | SED |
| ST24000NM002H | Exos X24 | 24TB | SATA | 512e / 4Kn FastFormat | ISE |
| ST24000NM001H | Exos X24 | 24TB | SATA | 512e / 4Kn FastFormat | SED |
| ST12000NM007H | Exos X24 | 12TB | SAS | 512e / 4Kn model-dependent | ISE |
| ST12000NM005H | Exos X24 | 12TB | SAS | 512e / 4Kn model-dependent | SED |
| ST12000NM009H | Exos X24 | 12TB | SAS | 512e / 4Kn model-dependent | SED-FIPS |
| ST16000NM007H | Exos X24 | 16TB | SAS | 512e / 4Kn model-dependent | ISE |
The exact model number defines the security variant
Security capability cannot be inferred from the Exos generation or capacity alone. Exos X24 support pages list separate model numbers for ISE, SED and SED-FIPS configurations across SATA and SAS. Cloudzat stores each model independently so a standard listing does not inherit SED or FIPS claims from another variation. When a retailer page combines several models, select the exact model first and confirm the label, interface and security fields before relying on the description.
Standard and ISE-capable models
A standard data drive may be the simplest operational choice. Some Exos exact models are identified by Seagate as supporting Instant Secure Erase even though they are not presented as host-managed SED variants. ISE is primarily a rapid sanitization capability for retirement or repurposing. It should not be described as the same thing as enabling authenticated drive locking for daily access control. Verify the supported erase command and exact model before planning a disposal workflow.
What a self-encrypting drive does
An SED encrypts data through an onboard encryption engine as information is written to the media. Seagate's X24 manual states that the encryption engines are always operating. The security benefit depends on ownership and locking configuration: encryption that is always active does not automatically mean the drive will refuse access after removal. To use controlled access, the host must support the relevant Trusted Computing Group commands and the administrator must configure credentials and locking behavior.
SED locking requires a compatible host
Managed SED features are not activated by simply installing the disk. The controller, HBA, operating system or storage-management platform must be able to send the appropriate security protocol commands. A controller that passes ordinary reads and writes may still block or hide TCG management. Before purchasing SED models, confirm that the chosen platform supports the exact protocol, drive interface and operational workflow for unlocking after boot, replacing failed drives and recovering credentials.
What ISE changes
Instant Secure Erase destroys access to existing encrypted data by changing or invalidating encryption keys, allowing a drive to be sanitized rapidly. Seagate's instructions use the PSID printed on the drive label for supported procedures. ISE is useful when retiring, returning or repurposing a drive, but it is intentionally irreversible. Photograph or inventory the label before installation, protect the PSID from casual exposure, and never run an erase procedure when required data has not been backed up.
SED-FIPS models
A FIPS SED is a self-encrypting drive whose cryptographic module has been validated against a defined FIPS program. The FIPS label supports specific compliance requirements; it is not a universal speed, reliability or data-recovery upgrade. Seagate notes that FIPS and auto-lock options are not available in every model or region and can require a TCG-compliant host or controller. Confirm the exact certificate, model, firmware and organizational requirement before paying the premium.
PSID, RevertSP and credential recovery
The PSID is a long identifier printed on the drive label. On supported SEDs it can authorize a destructive reset that returns security providers to factory state and erases data access. It is not a password that restores forgotten user credentials while preserving files. Asset management should record model, serial, PSID handling policy, ownership state and responsible administrator. A missing credential plan can turn an otherwise healthy encrypted drive into an unrecoverable operational incident.
Operating-system encryption versus drive encryption
ZFS native encryption, BitLocker, LUKS and other software encryption can provide policy flexibility independent of exact drive security variants. An SED can reduce CPU overhead and support rapid cryptographic erase, but it also introduces controller and credential dependencies. Some environments use both layers; others deliberately choose one. The correct decision depends on threat model, compliance, recovery requirements, key management, backup design and whether the drive may move between systems.
SATA and SAS security variants
Security type and interface are separate dimensions. A buyer can encounter SATA ISE, SATA SED, SAS ISE, SAS SED and SAS SED-FIPS exact models. Selecting the right security label does not solve an interface mismatch. Confirm the host can communicate with SATA or SAS, then verify sector format and security management. Marketplace filters that group all 24TB X24 drives together are particularly risky because several exact H-suffix models have different interface and security configurations.
Used and recertified SED risks
A previously owned SED may arrive locked, owned by another security authority or missing a usable PSID label. A seller may erase data without restoring the expected factory security state. Confirm that the drive is unlocked, the PSID is legible, the exact model is disclosed and the seller accepts returns for security-state problems. Warranty source and firmware provenance also matter. Do not store irreplaceable data until the drive has passed health checks and the security workflow has been tested.
Performance and reliability expectations
The security variant should not be treated as a proxy for better platters or longer life. Within a generation, standard and SED models can share core mechanical specifications. Seagate's X24 manual notes a small additional power draw for enabled security circuitry, but the practical buying decision is normally compatibility and governance rather than speed. Reliability still depends on exact model, condition, cooling, vibration, workload and warranty source.
Security-variant purchasing checklist
Define whether the goal is ordinary storage, rapid retirement erase, enforced data-at-rest locking or formal FIPS compliance. Identify the exact model, interface and sector format. Confirm host TCG support, boot-time unlocking, credential backup, failed-drive replacement and PSID inventory. Verify seller condition and warranty source. When no managed SED requirement exists, avoid adding operational complexity merely because the listing uses enterprise security terminology.
Current exact-model offers
Verify interface and model before purchase
ST14000NM001G
Seagate (Renewed) Exos X16 14TB 7200 RPM SATA 6Gb/s 256MB Cache 3.5-Inch Internal Data Center HDD Enterprise Hard…
$399.99
$28.57/TB
Warranty not verified
Buy on Amazon
ST12000NM002H
Seagate Exos X24 12TB 3.5" 6 Gb/s SATA III Internal Hard Drive
$479.93
$39.99/TB
Warranty not verified
Buy on Amazon
ST16000NM001G
Seagate 16TB HDD Exos X16 7200 RPM 512e/4Kn SATA 6Gb/s 256MB Cache 3.5-Inch Enterprise Hard Drive (ST16000NM001G) (Renewed)
$479.99
$30.00/TB
Warranty not verified
Buy on Amazon
ST18000NM004J
Seagate Enterprise ST18000NM004J Internal Hard Drive 3.5" 18TB SAS
$599.00
$33.28/TB
Warranty not verified
Buy on Amazon
ST16000NM002G
Seagate ST16000NM002G-R - Seagate 16TB 3.5" SAS 7.2K 12Gb/s Hard Drive (Renewed)
$637.44
$39.84/TB
Warranty not verified
Buy on Amazon
ST22000NM001E
Seagate (Recertified) Exos X22 22TB Internal Hard Drive - 3.5 Inch Hyperscale SATA 6Gb/s HDD, 7200 RPM, 2.5M…
$649.99
$29.55/TB
Seagate factory-recertified warranty — verify serial
Buy on Amazon
ST18000NM000J
Seagate Enterprise 3.5" 18000 GB 7200 RPM 18 TB 3.5" 7200 RPM SATA ST18000NM00J
$711.00
$39.50/TB
Warranty not verified
Buy on Amazon
ST20000NM002H
Seagate 20TB Exos Enterprise Hard Drive | SATA (ST20000NM002H)
$799.99
$40.00/TB
Claimed 5-year warranty — verify by serial number
Buy on Amazon
ST20000NM007D
Seagate Exos X20 ST20000NM007D 20TB 7.2K RPM SATA 6Gb/s 3.5in Hard Drive
$849.00
$42.45/TB
Warranty not verified
Buy on Amazon
ST28000NM003K
ST28000NM003K
$1,119.99
$40.00/TB
Claimed 5-year warranty — verify by serial number
Buy on Amazon
ST30000NM004K
ST30000NM004K
$1,199.99
$40.00/TB
Claimed 5-year warranty — verify by serial number
Buy on Amazon
ST20000NM007H
ST20000NM007H
$3,836.00
$191.80/TB
Warranty not verified
Buy on AmazonAmazon prices shown are retained for up to 24 hours. Latest price refresh: 2026-08-24 00:38:28 UTC. Price/availability may change; Amazon at purchase time controls.
Exos authority cluster
Continue the exact-model decision
Frequently asked questions
Exos compatibility answers
Is every Seagate Exos drive a self-encrypting drive?
No. Exos generations include separate standard, ISE, SED and SED-FIPS exact models.
Is ISE the same as SED locking?
No. ISE describes rapid cryptographic sanitization capability. Managed SED locking requires a compatible host and security configuration.
Does an SED encrypt data automatically?
The onboard encryption engine operates continuously, but access control and locking benefits require ownership and configuration.
What is the PSID on an Exos drive?
It is a physical security identifier printed on supported drive labels and used for destructive reset procedures such as PSID revert.
Can a PSID revert recover files?
No. It resets the security state by making prior encrypted data inaccessible. It is an erase operation, not data recovery.
Do I need an SED for TrueNAS encryption?
Not necessarily. TrueNAS supports software-level ZFS encryption and also has SED management options. Choose based on key management and recovery requirements.
Is SED-FIPS faster or more reliable?
FIPS validation concerns cryptographic compliance, not a general performance or mechanical-reliability improvement.
Can I use an SED like a normal drive without locking it?
Often yes, but exact behavior and management depend on the model and host. Confirm the security state before deployment.
Should I buy a used SED?
Only with clear exact-model disclosure, a legible PSID, verified unlocked state, health evidence, return rights and an understood warranty source.
How do I identify the security variant?
Use the complete model number and Seagate support documentation. Do not rely on capacity, family name or a generic retailer specification table.
Official references
Cloudzat may earn a commission from qualifying purchases. Compatibility recommendations are advisory; confirm the exact drive model, controller, backplane, sector format and appliance support list before purchase or data migration.