Cookies, jsessionid and encryption

Hi All,  Im relatively new to this. Our company had a third party do a pentest on our External apps in a DMZ. We had one call out for cookie information disclosure, so we turned on cookie encryption...