Encryption in Use: Confidential Computing and the End of Trusting the Provider

Modern encryption has an embarrassing gap in the middle of it. Data at rest is encrypted. Data in transit is encrypted. But the moment a processor needs to actually use that data, it is decrypted into memory — where it sits, in the clear, on infrastructure operated by somebody else. Every cloud architecture for the last twenty years has quietly rested on a single promise made by the provider: trust us with the keys, the hypervisor, and the operators.

What Changed

Confidential computing is the industry's attempt to stop taking that promise on faith. It works by pinning a workload into a hardware-isolated trusted execution environment — Intel TDX, AMD SEV-SNP, Arm's Confidential Compute Architecture, and a newer generation of confidential GPUs for AI workloads — where the hypervisor, the cloud operator, and even a privileged administrator on the host cannot read the memory contents. The cryptographic hook is remote attestation: the hardware produces a signed measurement of exactly what code is running, and keys are released to that workload only if the measurement matches what the relying party expects. Instead of trusting the provider, you verify what the provider is actually running.

Why 2026 Is the Inflection Point

Two forces converged. The first is agentic AI. When an enterprise hands sensitive prompts, retrieved documents, and model weights to a third-party inference environment, the exposure stops being theoretical, and confidential computing gives a way to run inference where the operator cannot read the data. Industry forecasts for the market vary wildly — respectable analyst estimates for 2026 range from roughly fifteen to seventeen billion dollars, with growth rates that differ by more than an order of magnitude depending on the vendor — so treat any single figure as directional. The second force is regulatory: sovereign cloud requirements, cross-border data handling rules, and multi-party analytics all need computation on data that the computing party is not allowed to see.

Confidential Computing and Homomorphic Encryption Are Not the Same Thing

Fully homomorphic encryption goes further in theory, allowing computation directly on ciphertext so that data is never decrypted at all. In practice it remains performance-limited for general workloads, which is why the two techniques are converging into a division of labor: homomorphic encryption for narrow, high-sensitivity computations, and confidential computing for the broad middle of enterprise workloads. Confidential computing is not a weaker substitute; it is the pragmatic option that runs today's software.

What to Check Before Committing

• Attestation-first key management: If your key management system cannot be configured to release keys only to an attested measurement, the TEE is decoration.
• Know the threat model: Confidential computing protects data from the infrastructure operator. It does nothing about a vulnerable application inside the enclave.
• Measure the overhead: Memory encryption costs performance, and the number varies enough by workload that a benchmark on your own code is the only meaningful test.
• Watch the metadata: Logs, metrics, orchestration events, and network patterns still leak information even when memory is sealed.

The notable shift this year is rhetorical as much as technical. Enterprises have begun writing attestation requirements into procurement documents, which means the question has changed from whether a provider can be trusted to how a provider proves what it is running. That is a healthier question, and it is the one confidential computing finally makes answerable.