Enterprise AI Security: How to Protect Data, Models, and AI Agents
The AI trust gap is widening.
Enterprise AI adoption grew quickly in 2026, but security hasn’t kept pace. It’s not that AI leaders don’t know about the risk, but they lack proof that they’re able to close it.
A recent survey commissioned by Fortanix, fielded by Atomix Research among 300 AI leaders across banking, financial services, healthcare, insurance and government, found that 93% are aware that traditional encryption stops protecting data when it’s being processed in memory, as it is during AI inference.
At the same time, only half of those leaders say they can fully verify that sensitive data stays protected while a model is actively running inference on it, while 46% say they can only partially verify it.
That gap has created tangible consequences: 59% of organizations have delayed an AI project in the past year due to security or privacy concerns, and 46% said regulatory compliance is the single biggest obstacle to deploying AI on their sensitive data. Further, 41% have completely shut down an AI deployment over security concerns, and another 31% have seriously considered it.
Use cases in highly regulated industries tend to hit the same wall. Knowing data is at risk during inference is one thing, but proving it’s protected is another. And most organizations still aren’t able to do it with confidence.
AI Has Created Three New Attack Surfaces
Traditional cybersecurity mainly protects data at rest and in transit, but that’s not enough for AI. When enterprise data or a proprietary AI model is loaded into memory for processing, most legacy security solutions can’t provide full protection.
That gap, along with the accelerated AI adoption rate, has created three risk categories:
- Data exposure during training and inference. AI systems are powered by large volumes of sensitive data, and each stage of the AI lifecycle is an opportunity for that data to leak. Training data could be poisoned or stolen, and inference data could sit unprotected in GPU and CPU memory while a model processes it. This is the gap the Fortanix/Atomik report uncovered: 93% awareness versus only 50% full verification. That’s likely why only 44% of AI leaders described themselves as “very confident” that their data is protected during inference.
- Model theft and manipulation. AI models are becoming prized assets for many organizations, representing years of research and investment. Attackers target this valuable intellectual property by reconstructing training data based on outputs, through API probing that can reveal proprietary architecture, or by using inputs designed to manipulate what the model produces. The survey found that 93% of AI leaders are concerned about exposing proprietary prompts, models or IP to infrastructure providers, including 38% who are “very concerned.” Still, 61% report sending sensitive data to public cloud AI services anyway because they need to stay competitive.
- AI agent sprawl. AI agents have entered the mainstream consciousness, and they’ve brought new risks with them. Agents do more than process data; they act on it, ideally with stringent permissions across systems. As it stands, the risks they create are shared, with survey respondents saying enterprise security teams take responsibility just 27% of the time. The rest of the risk is split between AI engineers, infrastructure teams and model owners. That shared ownership means no single team is fully accountable if and when something goes wrong.
In addition to these three risk areas, organizations in regulated industries must keep governance and compliance in check. Frameworks like the EU AI Act and others require organizations to prove that AI systems handle data responsibly, and that proof is what half of organizations say they can’t take on today.
Secure the Full AI Lifecycle, Not Just the Perimeter
Properly securing enterprise AI requires shifting where security is applied in the first place. Old-school perimeter defenses and encryption at rest and in transit are still necessary, but they leave the most vulnerable phase of the AI lifecycle unprotected: inference, when data and models are actively in use.
Protecting the full lifecycle takes four capabilities that work together:
- Encryption of data in use. Sensitive data and proprietary model weights must stay encrypted even while a model is actively processing them.
- Hardware-backed isolation. AI workloads should run in environments that can’t be accessed by the underlying infrastructure, the operating system, or administrators with high levels of security privileges.
- Verifiable attestation. Organizations (not to mention regulators and auditors) need cryptographic proof that an AI workload is running in an untampered environment.
- Centralized governance for models and data. Identity access, key management, and audit logging need to cover the entire AI lifecycle, including agentic systems, which need their own layer of permission management and monitoring.
AI leaders are gravitating towards the same answer. The Fortanix-Atomik survey found that advanced infrastructure security like Confidential Computing was the top response when asked what they could do to increase confidence in deploying AI on sensitive data.
An overwhelming majority of respondents said sovereign AI is important to their business strategy and that they’re at least somewhat likely to adopt leading AI models if they were available securely on-premises. Confidential Computing is what makes this a reality, due to its use of trusted execution environments (TEEs), which isolate and encrypt data and models while they’re being processed.
That means teams don’t need to trust the surrounding infrastructure; workloads prove their own integrity through cryptographic attestation.
How Fortanix Secures Enterprise AI
Fortanix is the industry pioneer of Confidential Computing, and it’s now applied to infrastructure designed specifically to address this AI challenge. It gives enterprises a way to secure data, models, and agents across the lifecycle rather than addressing each risk separately.
Let’s take a closer look at some of the components that make it work:
- Fortanix Confidential AI: Extends the protection to AI infrastructure, with support for NVIDIA’s Confidential Computing GPUs, including Hopper and Blackwell architectures. This allows enterprises to run frontier models on-premises or in sovereign environments without exposing training data or model weights. AI labs and model owners have historically been reluctant to allow their most valuable models to be deployed on-premises due to the threat of IP theft. Confidential Computing changes that by making deployments provably secure.
- Fortanix Confidential Computing Manager (CCM): Manages attestation across the AI environment, verifying that workloads are running in tamper-proof trusted execution environments before any sensitive data or model gains access. This verification protects the data, of course, but it also gives regulators auditable proof that an AI system is secure.
- Fortanix Data Security Manager (DSM): Centralizes key management and enforces secure key release. That means encryption keys that protect sensitive data and proprietary models only get released after the attestation process confirms the workload’s integrity, essentially locking down data and models until they’re proven to be running in a trustworthy environment.
These powerfully combined capabilities give teams hardware-level isolation for AI models and sensitive data, aligning with zero-trust approaches that keep even privileged administrators from accessing sensitive workloads. Organizations can confidently deploy AI on-premises or in sovereign environments knowing their data and models meet data residency and compliance requirements.
In practical terms, this means:
- Banks and other financial institutions can prove the protection of transaction data and fraud models.
- Healthcare organizations can use patient data in AI models without exposing it or violating HIPAA.
- Government agencies can cryptographically prove where and how AI runs to meet sovereign deployment requirements.
Regulations around the world will only continue to tighten, and Confidential Computing lets enterprises scale their AI infrastructure with them.
Enterprise AI Security is a Lifecycle Problem. It Needs a Lifecycle Solution.
The gap between what AI leaders know and what they can prove won’t close on its own. When 93% understand the risk but only half can verify their organization is covered, that gap leads to real-world consequences, such as delayed or blocked projects.
Fixing it starts with securing the full AI lifecycle, from the data that trains a model to the model itself and the agents that now act on its outputs. Confidential Computing makes it possible by encrypting data and models during inference and verifying every workload with cryptographic attestation.
It’s provable trust that regulators and auditors now require.
For a closer look at how Confidential Computing protects AI models or how sovereign AI deployments work in regulated industries, contact us today.
Note: Stats in this article were drawn from the Fortanix /Atomik Research survey report “How the AI Trust Gap is Shaping the Future of Enterprise AI Deployment,” fielded July 17-29, 2026. For more results and to download the entire report, visit https://www.fortanix.com/resources/reports/state-of-enterprise-ai-deployment.
