The Gap in Conventional Data Security
Enterprise data security operates on two well-understood protection boundaries: data at rest (encrypted on disk, in databases, in object storage) and data in transit (encrypted over the network using TLS). For decades, these two boundaries were sufficient - data was only vulnerable when being actively processed, and processing happened in trusted internal environments.
AI changes this assumption. Enterprises are sending sensitive data to external AI models for inference, outsourcing AI training to cloud environments they do not physically control, and sharing regulated data across organizational boundaries for collaborative AI workloads. In all three cases, data is unencrypted and exposed during processing - in memory, on CPU, visible to the cloud provider's infrastructure and anyone who compromises it.
This is the in-use data problem, and confidential computing is the solution.
What Confidential Computing Is: Trusted Execution Environments
Confidential computing uses hardware-enforced Trusted Execution Environments (TEEs) to protect data and code during processing. A TEE is a secure enclave within the processor where:
- Memory is encrypted and inaccessible to the host operating system, hypervisor, cloud provider infrastructure, and other tenants
- Code is attested - the software running inside the TEE can be cryptographically verified before sensitive data is sent to it
- Outputs are the only thing that leaves the enclave - raw data never exits in plaintext
The protection operates at the hardware level, not the software level. Even a privileged attacker with root access to the host machine cannot read memory inside a TEE. Even the cloud provider cannot see data being processed in a confidential VM running on their infrastructure.
Enterprise AI Use Cases
Confidential computing addresses three high-value enterprise AI scenarios that are currently blocked by data protection concerns:
HIPAA-compliant AI inference: Hospitals and health systems that want to use external AI models for clinical decision support face a HIPAA barrier - sending patient data to a third-party model is potentially impermissible without a Business Associate Agreement and data processing controls. Confidential computing allows patient data to be sent to an AI model running in a TEE where it is provably protected during inference, enabling compliance with technical safeguards that standard cloud AI APIs cannot provide.
Financial model outsourcing: Banks and asset managers that want to use specialized AI for credit underwriting, fraud detection, or risk modeling cannot send unencrypted customer financial data to external vendors. Confidential computing enables the model to run in a protected enclave processing customer data without the financial institution exposing raw records to the model vendor.
Regulated data sharing for collaborative AI: Pharmaceutical companies sharing clinical trial data for joint AI development, or financial institutions pooling fraud signal data without exposing individual customer records, use confidential computing as the trust boundary that makes cross-organizational data collaboration possible under regulatory constraints.
Market Scale and Gartner Positioning
The confidential computing market is growing rapidly: independent analysts estimate the market at $24B+ with a CAGR exceeding 64%, driven by AI adoption in regulated industries. Gartner named confidential computing a top-10 strategic technology for 2026, citing its role in enabling enterprise AI adoption in sectors where data protection requirements had previously blocked deployment.
Cloud provider support is mature. AWS offers Nitro Enclaves. Microsoft Azure has Confidential Computing VMs and a Confidential Computing Consortium initiative. Google Cloud provides Confidential VMs with AMD SEV (Secure Encrypted Virtualization). Intel's TDX (Trust Domain Extensions) and AMD's SEV-SNP provide the underlying hardware foundations across cloud and on-premises deployments.
Designing AI Workloads for Confidential Computing
Adopting confidential computing requires architectural changes to AI workloads. Performance is the primary constraint: TEE-protected computation carries a 5–30% overhead depending on memory encryption intensity and workload type. AI inference workloads are typically within the acceptable overhead range; large-scale training workloads may require architectural optimization.
Attestation is the other design requirement. Before sending sensitive data to a TEE, the requesting system must verify the attestation report - the cryptographic proof of what software is running in the enclave - to confirm that the enclave is legitimate and unmodified. This verification step must be integrated into the data flow, adding a one-time handshake before each confidential session.
Isotropic designs enterprise AI architectures that treat confidential computing as a foundational security layer for regulated workloads - integrating attestation, enclave lifecycle management, and performance optimization from the architecture phase rather than retrofitting them onto existing systems. Contact business@isotrp.com to discuss confidential computing for your regulated AI use cases.
FAQ
Frequently asked questions
What is confidential computing and how does it differ from encryption at rest and in transit?
Confidential computing protects data during processing - while it is being used by the CPU. Encryption at rest protects data on disk or in storage. Encryption in transit protects data moving over networks. Before confidential computing, data had to be decrypted and exposed in plaintext during processing, creating a window of vulnerability. Confidential computing uses hardware-enforced Trusted Execution Environments (TEEs) to keep data encrypted in memory, inaccessible even to the cloud provider's infrastructure.
What is a Trusted Execution Environment (TEE)?
A TEE is a hardware-enforced secure enclave within a processor where memory is encrypted and inaccessible to the host operating system, hypervisor or cloud provider. Code running in a TEE can be cryptographically attested - the requesting party can verify what software is running before sending sensitive data. Intel TDX, AMD SEV-SNP, and ARM TrustZone are the primary hardware implementations. Cloud providers expose TEEs as Confidential VMs or secure enclaves through services like AWS Nitro Enclaves, Azure Confidential Computing, and Google Cloud Confidential VMs.
Which cloud providers support confidential computing?
All three major cloud providers have mature confidential computing offerings. AWS provides Nitro Enclaves for isolated computation and Graviton-based confidential instances. Microsoft Azure offers Confidential Computing VMs using AMD SEV and Intel TDX, plus Azure Attestation for enclave verification. Google Cloud provides Confidential VMs with AMD SEV-SNP and Confidential GKE nodes for containerized workloads. On-premises deployments can use Intel TDX or AMD SEV-SNP on compatible server hardware.
What performance overhead does confidential computing add to AI workloads?
TEE-protected computation carries a 5–30% performance overhead depending on memory encryption intensity and workload characteristics. AI inference workloads - which are typically memory-read-heavy rather than write-heavy - tend to fall at the lower end of this range and are generally within acceptable bounds. Large-scale AI training workloads with intensive memory writes may require architectural optimization. Benchmarking on representative workloads before committing to a TEE-based architecture is essential for accurate capacity planning.
Is confidential computing required for HIPAA-compliant AI inference?
HIPAA does not mandate a specific technical implementation for AI inference, but it requires that covered entities and business associates implement appropriate technical safeguards for Protected Health Information (PHI). Standard cloud AI APIs - where the provider can access data in plaintext during processing - are often insufficient under strict interpretations of HIPAA's technical safeguard requirements. Confidential computing, combined with a Business Associate Agreement, provides a technical basis for HIPAA-compliant external AI inference. Organizations should consult legal counsel on their specific compliance posture.