Encryption is used by default, however it's a subject to supported ciphers and negotiation during initial handshake — with plain text fallback. To ensure that network traffic is always encrypted (or connection is rejected), add "RequireEncryption=yes" to nxagentd.conf.