Confidential Computing Explained: Why "Encrypted While in Use" Is the New Security Frontier
Confidential computing encrypts data and code while they're actively being processed, not just when stored or transmitted, by running them inside a hardware-isolated "trusted execution environment" (TEE) that even the cloud provider or system administrator can't see into. Gartner named it one of its top strategic technology trends for 2026 and forecasts that more than 75% of workloads processed on untrusted infrastructure will be secured this way by 2029, up from a small fraction today. What makes 2026 the actual inflection point isn't compliance pressure from banks or hospitals, the technology's original pitch — it's that frontier AI labs are now the ones pushing the hardware forward, because TEEs turned out to be the most credible answer to a problem they can't solve any other way: protecting model weights from theft.The Gap Confidential Computing Was Built to Close
Classical data protection covers two of three states data can be in: encrypted at rest (on a disk) and encrypted in transit (moving across a network). The third state — data in use, while a CPU or GPU is actively computing on it — has historically had to be decrypted in plaintext in memory for the processor to work with it. That plaintext window is where cloud operators, malicious insiders, compromised hypervisors, and anyone with physical data-center access could theoretically inspect or tamper with it. A trusted execution environment closes that window. Data and code run inside a hardware-enforced enclave — backed by chip-level technology like Intel TDX, AMD SEV-SNP, or AWS Nitro — that isolates them from the host operating system, the hypervisor, and the cloud provider's own administrators. A cryptographic process called attestation lets a customer verify, before sending any sensitive data, that the enclave is running exactly the hardware and software configuration it claims to be — not a modified version an attacker might have swapped in.Why 2026, Specifically
The technology isn't new — Google Cloud launched Confidential VMs in 2020, and Intel SGX predates that. What's new is that confidential computing just became usable for the workload that dominates enterprise IT budgets: AI. For years, TEEs were CPU-only, which made them useless for GPU-hungry model training and inference — exactly the workloads companies most wanted to protect. Nvidia's H100, built on the Hopper architecture, became the first GPU with native confidential computing support when it reached general availability in 2024, followed by H200 and Blackwell-generation B200 GPUs with encrypted NVLink for multi-GPU workloads. Microsoft Azure became the first cloud provider to offer H100 GPUs inside confidential virtual machines, pairing Intel TDX on the CPU side with Nvidia's GPU-level Confidential Computing Engine so an entire training or inference pipeline can run encrypted end to end. That hardware milestone is why the market data has shifted so sharply in a single year. Fortune Business Insights' 2026 analysis puts the global confidential computing market at $42.74 billion in 2026, projecting growth to $463.89 billion by 2034 at a 34.7% compound annual growth rate — a far larger and more AI-driven forecast than the industry's earlier reference point, Everest Group's 2021 projection of roughly $54 billion by 2026. The revision itself is telling: the earlier estimate was built around bank and healthcare compliance use cases; the current one is built around AI infrastructure.The Real News: Frontier AI Labs Are Now Writing the Research
The strongest evidence that confidential computing has moved from a compliance checkbox to a live security frontier is who's publishing about it. In June 2025, Anthropic and the security firm Irregular (formerly Pattern Labs) published a joint whitepaper on confidential inference systems, framing the problem explicitly around protecting model weights from theft by "leading cyber-capable institutions and the most capable nation-states" — referencing RAND Corporation's SL4 and SL5 security levels, the same scale used in AI safety policy discussions about frontier model security. The design goal described in the paper is an end-to-end encrypted channel where, in the company's words, nobody except the data owner and the AI model itself can access the data being processed. Anthropic isn't alone. OpenAI's May 2024 post on secure infrastructure for advanced AI listed accelerator-level confidential computing as its first priority category, calling for trusted computing to extend beyond the CPU and into AI accelerators directly. Google DeepMind's Frontier Safety Framework similarly lists confidential-compute-capable hardware as part of its highest security tier, where model weights should not be casually accessible even to the company's own staff. Apple took the most public approach: its Private Cloud Compute system, launched alongside Apple Intelligence, publishes production software images for independent binary inspection and has expanded its security bounty program specifically to cover PCC, with Apple's broader bounty program having paid close to $20 million to researchers over roughly two and a half years. This is a meaningfully different justification than the technology's original sales pitch. Confidential computing was marketed for a decade primarily as a regulatory-compliance tool for banks and hospitals handling sensitive customer data. The 2026 story is that the companies building the world's most valuable software assets — frontier model weights, worth hundreds of millions of dollars in training compute alone — consider hardware-enforced isolation from their own cloud infrastructure a serious defense against nation-state-level theft, not just an audit checkbox.What It Actually Costs
The honest counterpoint to the momentum is performance overhead, and it's real, if smaller than it used to be. Nvidia publishes a 2–5% throughput overhead for confidential computing mode on H100 for most LLM inference workloads, with independent measurements generally landing in a similar 5–15% range depending on model size and configuration, plus a one-time attestation cost of one to a few seconds at instance startup. That's a meaningful but no longer prohibitive tax — a large drop from the CPU-only TEEs of a few years ago, which struggled to support resource-intensive workloads like LLM inference at all. The bigger practical limitation isn't performance — it's that "confidential computing" isn't one uniform guarantee across providers, and treating it as if it were creates a false sense of security. AWS Nitro Enclaves, for example, isolate CPU-side computation with no persistent storage and no operator access, which makes them excellent for protecting keys or signing material — but the Nvidia GPU on the same instance sits outside that enclave boundary, meaning any data crossing the PCIe bus to the accelerator is visible to the host hypervisor. Azure's confidential GPU VMs, by contrast, pair Intel TDX with Nvidia's Hopper-generation Confidential Computing Engine so the CPU and GPU jointly produce a single attestation report covering the full pipeline. Buyers comparing "confidential computing" across AWS, Azure, and Google Cloud are often comparing genuinely different security architectures wearing the same label — which is exactly the kind of distinction a compliance team, not a procurement spreadsheet, needs to resolve.Where the Technology Still Has Real Limits
Confidential computing is not a solved problem, and the research literature is candid about that. Independent analyses of GPU-based confidential computing note that GPU memory protection on current-generation hardware relies partly on access control rather than full runtime encryption, that certain synchronization metadata remains exposed in plaintext, and that timing patterns in memory transfers could theoretically leak information through side channels — the same category of side-channel risk that has affected CPU-based TEEs like Intel SGX in the past. Hopper-generation GPUs also don't yet fully support confidential computing for the largest-scale training workloads, a gap that Nvidia's Blackwell architecture is only beginning to address. None of this undermines the core value proposition, but it does mean "confidential computing" claims deserve the same scrutiny as any other security claim: which specific threat model does this protect against, and which does it not?What This Means for a Technical Team Evaluating It Now
The AI use case is the one actually maturing fastest. Regulated-industry data sharing was the original pitch, but GPU-level confidential computing arrived specifically to solve AI model and data protection, and that's where hardware vendors are investing next.
Attestation is the feature that matters, not just encryption. Encrypting memory is necessary but not sufficient — the ability to cryptographically verify what code is actually running inside the enclave, before trusting it with sensitive data, is what separates confidential computing from ordinary encryption.
Check whether the GPU is actually inside the trust boundary. Some cloud "confidential computing" offerings protect only the CPU side, leaving GPU-bound data exposed at the hardware boundary; others extend the enclave and a single attestation across CPU and GPU together.
Budget single-digit-to-teens percentage overhead, not zero. Current published figures put GPU confidential computing overhead in the low single digits to mid-teens depending on workload, plus a small attestation cost at startup — a real but generally acceptable cost for the workloads that need it.
Comments
Log in or sign up to join the discussion.
Loading comments…