Confidential AI: The Security Foundation for Enterprise AI

Most enterprise AI projects do not fail due to poor models. Instead, they stall early because organizations cannot exploit advanced AI models on sensitive data without risking exposure.

This challenge affects hospitals unable to share patient records with public APIs, financial institutions restricted from transferring trading data externally, and any enterprise evaluating the gap between AI requirements and current security capabilities.

Confidential AI is emerging to address this issue. It offers a new approach to securing workloads, enabling adoption across regulated industries, sovereign cloud deployments, and organizations giving priority to data and model protection.

The "In-Use" Security Gap That Blocks Enterprise AI

Understanding confidential AI begins with identifying the specific security gap it addresses.

On traditional infrastructure, AI workloads require data to be decrypted and loaded into memory for processing. During this time, anyone with sufficient system access, including the host operating system or privileged administrators, can view the data. Attackers with the appropriate access can also compromise this information.

This is known as the "in-use" security gap. Protecting data during active computation is significantly more challenging than securing data at rest or in transit, and is especially critical for AI.

AI model owners face the same risk. Advanced models constitute substantial research, investment, and proprietary design. When deployed on infrastructure outside the owner's control, model weights are loaded into memory and can be extracted by anyone with sufficient privileges. This poses an unacceptable risk to model owners.

This creates a standoff: enterprises cannot share sensitive data with external AI services, and model owners cannot securely deploy proprietary models on enterprise infrastructure. Confidential AI resolves this impasse.

Attestation: What Makes Confidential AI Work

Confidential AI leverages confidential computing technology, a hardware-based security architecture, for AI workloads. Its foundation is trusted execution environments (TEEs), which are isolated, hardware-enforced enclaves within a processor that provide strong security guarantees for code and data.

Inside a TEE, the host OS can't inspect the workload. Within a TEE, the host operating system, hypervisor, and even privileged administrators cannot access the workload. While software policies may be bypassed, this isolation is enforced at the hardware level, making it significantly more difficult to compromise.

Data stays encrypted in memory during inference (not just at rest or in transit), model weights and architecture are protected from extraction, and the host OS, administrators, and infrastructure operators have no visibility into the workload. Confidential AI protects against insider threats and privilege abuse at the infrastructure level, not just external attackers.

Remote attestation constitutes another essential component. Before a confidential AI workload executes, the system conducts a cryptographic verification to confirm the hardware environment is authentic and unaltered, and that the software within the TEE matches expectations.

Encryption keys are released only after successful attestation. If any aspect of the environment is compromised, attestation fails, keys are withheld, and the workload does not run, making sure all data and models remain protected.

Confidential AI guarantees cryptographic proof that the environment is authentic.

Fortanix Confidential AI Delivers in Production

Fortanix pioneered confidential computing over a decade ago and has developed a platform specifically designed for enterprise AI at scale.

The platform operates on NVIDIA Hopper and Blackwell GPUs, providing protection throughout the entire GPU pipeline where AI inference occurs. CPU-only TEE protection does not safeguard the computational environment where most AI workloads, which are GPU-intensive, actually run. This distinction is critical.

Fortanix Confidential Computing Manager (CCM) creates and manages secure enclaves to isolate AI workloads. Before releasing encrypted assets, CCM conducts composite CPU and GPU attestation to verify the integrity of both environments. Fortanix Data Security Manager (DSM) ensures encryption keys are provided only to verified, attested TEEs. If attestation fails, the keys remain locked.

This system allows enterprises to use their own data and model owners to deploy their own models, with both parties receiving cryptographic assurance that their assets are protected. Trust in each other or the infrastructure operator is not required. For AI factory operators, including enterprises, sovereign cloud providers, and neoclouds offering token-metered AI services, this provides the security indispensable foundation for practical enterprise-grade deployment.

The demand for solid security has increased with AI adoption. Previously, organizations used sanitized datasets and proof-of-concept workloads. Now, deployments involve clinical records, financial models, legal documents, proprietary research, and operational intelligence.

Agentic AI increases risk by expanding the attack surface through multi-step workflows, external tool integration, and continuous access to internal systems. Additionally, data sovereignty regulations in the EU, the Middle East, and Southeast Asia now require hardware-level cryptographic enforcement as a standard.

*Learn more about: What is confidential AI?

The Precondition for Enterprise AI

Confidential AI is often viewed as an add-on security feature for compliance. However, this perspective understates its true significance.

In high-risk sectors such as healthcare, finance, defense, critical infrastructure, and sovereign governments, confidential AI is a prerequisite for deployment. Without it, data cannot be shared and models cannot be trusted.

Leading enterprises are integrating confidential AI into their architecture from the outset, rather than retrofitting it later. This approach enables scalable enterprise AI across agentic systems, sovereign deployments, and high-sensitivity inference pipelines.

Fortanix Confidential AI is built to be that foundation.