Enterprises attempting to scale generative AI face a fundamental security paradox: the very data and model weights required for high-performance inference must be decrypted in memory, leaving them vulnerable to infrastructure operators and privileged administrators. Fortanix is positioning its Confidential AI platform to resolve this "data-in-use" vulnerability by announcing support for CNCF Confidential Containers (CoCo). This integration allows organizations to execute AI workloads, including frontier models and autonomous agents, within hardware-based Trusted Execution Environments (TEEs) on Kubernetes. By leveraging CoCo, Fortanix aims to bridge the gap between the operational agility of containerized microservices and the rigorous isolation required by regulated sectors. This development arrives as new research from Fortanix and Atomik Research indicates that while 93% of AI leaders recognize the inadequacy of traditional encryption for data in process, only 50% can currently verify that protection is active during inference.
Securing the AI Execution Path via CoCo
The technical core of this announcement involves the deployment of open-source plugins designed to connect the Fortanix Confidential Computing Manager (CCM) for attestation with the Fortanix Data Security Manager (DSM) for secure key release. Within the standard CNCF Confidential Containers workflows, these plugins function as a gatekeeper, verifying that every container is genuine and running inside a TEE before any encryption keys are released. This process utilizes composite attestation, which verifies both the underlying hardware and the specific AI workload simultaneously to ensure the entire execution path is trusted.
For the enterprise, this architecture addresses the specific risk of model extraction and data leakage during the inference phase. Because the encryption keys remain within the Fortanix Data Security Manager—a FIPS 140-2 Level 3 certified hardware security module (HSM)—they are never exposed to the host operating system or the cloud provider. This allows for the deployment of proprietary models from frontier AI labs in on-premises or air-gapped environments, effectively enabling "sovereign AI" where the model owner's intellectual property and the enterprise's sensitive data remain isolated from one another. The platform is designed for high availability through clustered deployments, ensuring that the key release mechanism does not become a single point of failure in production-scale Kubernetes environments.
Scaling Confidential AI Across Heterogeneous Infrastructure
The move toward Confidential Containers is supported by a broad ecosystem of hardware and software providers, signaling a shift toward standardized, hardware-rooted security for AI. Industry participants including NVIDIA, AMD, Intel, and Cisco have highlighted the necessity of protecting data while it is actively being processed. For instance, NVIDIA is utilizing this open-source collaboration to ensure that both data and model weights remain private through NVIDIA Confidential Computing. Similarly, AMD is providing the foundational EPYC processors and Instinct accelerators required to support these confidential workloads.
This ecosystem approach allows for deployment flexibility across various environments, including SaaS, on-premises, and disconnected, air-gapped setups. This is particularly relevant for regulated industries such as financial services, healthcare, and government, where data sovereignty is a non-negotiable requirement. By integrating with Kubernetes-native tools, Fortanix is attempting to make confidential computing a standard component of the AI stack rather than a bespoke, high-friction security add-on. The goal is to allow developers to deploy these workloads with "one click" across supported hardware, maintaining the speed of containerized development while meeting strict compliance standards like SOC 2 Type 2 and ISO/IEC 27001.
Key Takeaways
- Fortanix has added support for CNCF Confidential Containers (CoCo), enabling AI workloads to run in hardware-based Trusted Execution Environments (TEEs) on Kubernetes.
- The solution uses composite attestation to verify both the hardware and the AI workload before releasing encryption keys from the FIPS 140-2 Level 3 Fortanix Data Security Manager.
- The platform supports diverse deployment models, including SaaS, on-premises, and fully air-gapped environments, to accommodate sovereign and regulated data requirements.
TechInsyte's Take
In our view, Fortanix is targeting the most significant bottleneck in enterprise AI adoption: the "trust deficit" regarding data in use. While the industry has spent years perfecting encryption for data at rest and in transit, the inference phase has remained a glaring security blind spot. By embedding itself into the CNCF Confidential Containers ecosystem, Fortanix is not just selling a security product; it is attempting to standardize the "trust layer" for the entire Kubernetes-based AI economy.
This move is strategically significant because it shifts the burden of proof from the enterprise to the infrastructure. Instead of asking a cloud provider to promise they cannot see the data, enterprises can now use cryptographic attestation to verify it. This capability is essential for the rise of "agentic AI," where autonomous models handle increasingly sensitive workflows. If enterprises cannot guarantee the privacy of the model's reasoning and the data it consumes, the deployment of frontier models in regulated sectors will remain stalled. Fortanix's integration with CoCo suggests that the future of secure AI will be built on open, hardware-rooted standards rather than proprietary, vendor-locked silos.
Questions & Answers
How does Fortanix address the vulnerability of data during the AI inference process?
Fortanix utilizes hardware-based Trusted Execution Environments (TEEs) to isolate AI workloads. By using composite attestation, the system verifies that both the hardware and the specific AI workload are genuine and unaltered before the Fortanix Data Security Manager releases the necessary encryption keys into the protected environment. This ensures that sensitive data and model weights are never decrypted in a way that is accessible to the host OS, cloud operators, or privileged administrators.
What is the strategic advantage of using Confidential Containers (CoCo) for AI workloads?
Using CoCo allows enterprises to maintain the scalability and agility of Kubernetes-based container orchestration while adding a layer of hardware-enforced isolation. This enables developers to deploy AI models and agents using standard container workflows while providing leadership with the cryptographic certainty required for regulatory compliance and intellectual property protection.
Which industries are most likely to benefit from this Confidential AI integration?
The technology is specifically positioned for highly regulated and sovereign environments, including financial services, healthcare, pharmaceuticals, and government agencies. These sectors require the ability to run frontier AI models on sensitive data without exposing that data or the models themselves to the infrastructure provider, often in on-premises or air-gapped settings.
What hardware and software ecosystem supports this deployment?
The solution is designed to work across a wide array of industry-standard technologies, including NVIDIA GPUs with Confidential Computing, AMD EPYC and Instinct accelerators, and Intel TDX. It also integrates with Kubernetes-native environments and is supported by an ecosystem of partners including Red Hat, Cisco, and various cloud and AI infrastructure providers.
Source: Fortanix
