What Is Confidential Computing and How Does It Work?

Confidential computing protects data while a computer is working on it. The data sits inside a sealed area of the processor, called a trusted execution environment (TEE), where it stays encrypted in memory and hidden from the operating system, the hypervisor and the cloud provider’s staff. Before any secret goes in, the sealed area proves what code it is running through a step called attestation.

That last part is what makes it new. Encryption at rest protects a disk. Encryption in transit protects a network link. Neither helps once a program loads the data into memory to use it, and that gap is the one confidential computing closes.

The Problem Confidential Computing Solves: Data in Use

Think about a hospital that wants to run a fraud model on patient billing data in the cloud. The data can be encrypted on disk and on the wire. But the model has to read real numbers, so at some point the data is decrypted in the server’s memory.

At that moment, anyone with enough control of the machine could look. That includes a rogue administrator, a hacked hypervisor, or malware that has broken out of another virtual machine on the same host. The goal is to reduce trust in, or remove access by, the cloud operator itself. Microsoft says that when Azure confidential computing is set up correctly, it cannot access the unencrypted customer data.

The Confidential Computing Consortium, a Linux Foundation project that Microsoft co-founded in 2019, gives the formal definition: confidential computing “protects data in use by performing computation in a hardware-based, attested Trusted Execution Environment.” Each word in that sentence does a job, and the next section takes them one at a time.

How a Trusted Execution Environment Works Step by Step

A TEE is a part of the computer that the rest of the computer cannot see into. The protection comes from the processor, not from software that an attacker could patch or switch off. This is what happens when a company launches a confidential virtual machine.

1. The chip creates a private memory key. The processor generates an encryption key for that one VM. The key lives inside the chip and never leaves it in readable form.
2. Memory is encrypted on the way out of the chip. Every time the VM writes to RAM, the memory controller encrypts the data with that key. If someone reads the RAM chips directly, they see scrambled bytes.
3. The hypervisor loses its view. The host software can still start, stop and schedule the VM. It cannot read the VM’s memory or quietly change it, because newer designs such as AMD SEV-SNP add integrity checks that catch tampering.
4. The chip measures what booted. As the VM starts, the hardware records a hash of the firmware and early boot code. That record is the “measurement.”
5. The chip signs a report. On request, the processor signs the measurement with a key that traces back to the chip maker. This signed report is the attestation.
6. A key service checks the report. The workload sends the report to a key management service. Only if the hardware is genuine and the code matches what the owner expects does the service release the decryption key for the real data.

Step six is the clever part. The secrets never reach a machine that cannot prove what it is. If an attacker swaps in a modified boot image, the measurement changes, the report no longer matches, and the key stays locked away.

Attestation in Plain Terms

A simple way to picture attestation is a sealed delivery locker. The courier, in this case the key service, will only open the locker for a person who shows an ID that the issuing office signed. A forged ID fails the check. On AWS, for example, the Nitro Hypervisor produces a signed attestation document, and AWS KMS can read and verify it before it re-encrypts data to a key that only that enclave holds.

Enclaves Versus Confidential VMs

There are two main shapes of TEE, and they suit different jobs. Process-level enclaves wrap a small part of one application. Intel SGX works this way. The developer splits the program so that only the sensitive function, such as signing with a private key, runs inside the enclave.

Confidential virtual machines wrap a whole operating system instead. AMD SEV-SNP and Intel TDX use this model. The big benefit is that most existing software runs unchanged, because it simply boots inside a protected VM. The trade-off is a larger amount of code inside the trust boundary, which means more code that has to be correct.

AWS Nitro Enclaves sits between the two. An enclave is carved out of a parent EC2 instance as a separate, isolated VM with no persistent storage, no interactive access and no outside networking. The parent passes data in over a local channel.

Arm has its own design, the Confidential Compute Architecture, which Arm introduced with Armv9. It creates protected areas called Realms that are walled off from both the normal operating system and the hypervisor.

Confidential Computing Options from Each Major Cloud

We read each provider’s own documentation to see which hardware sits behind its confidential offers. The table lists the hardware each one names. It is a map of where to start, not a ranking.

Azure’s memory-optimized E series gives twice the memory per vCPU of the general-purpose D series. A “d” in the series name means the VM has a local temporary disk.

AWS is the odd one out. Nitro Enclaves is not a separate VM family with its own price. There are no additional charges, and you pay only for the EC2 instance and any other services you use. Enclaves do not run on bare metal instances, burstable T3 types, or instances with a single CPU core.

What Confidential Computing Costs on Google Cloud: Our Math

Google is the easiest provider to price because it publishes a flat surcharge that sits on top of the normal VM price. We took its on-demand Confidential VM rates and applied them to one common size: 8 vCPUs and 32 GiB of memory, running all month.

The method is simple. Hourly surcharge = (8 x vCPU rate) + (32 x memory rate). Monthly surcharge = hourly surcharge x 730 hours, which is the average number of hours in a month.

One result surprised us. The newer AMD SEV-SNP option, which adds memory integrity protection, carries about half the surcharge of plain SEV on the same N2D machines. If your workload fits on N2D, SNP gives you more protection for less money. Keep in mind that these figures are the add-on only. The base N2D or C3 machine price is charged on top.

GPUs cost more. Google lists a confidential surcharge of $0.45 per hour for a g4-standard-48 with one NVIDIA RTX PRO 6000, plus an NVIDIA software license fee of $0.08 per GPU per hour. Run all month, that is (0.45 + 0.08) x 730 = $386.90, again before the base GPU machine price. Google says these GPU charges do not qualify for sustained use or flexible committed use discounts.

To put the CPU numbers in context, $24.67 to $49.15 a month is small next to the cost of one breach investigation or a compliance audit finding. For a team running a few sensitive VMs, the hardware cost is rarely what stops a project. The engineering time to set up attestation and key release usually is.

Confidential AI on GPUs

The fastest-growing use is protecting AI models and prompts. A company may want to run a large language model on customer data without the cloud provider, or even its own operators, being able to see the inputs or the model weights.

NVIDIA’s Hopper H100 was the first data center GPU built with this in mind. The GPU joins the confidential VM’s trust boundary, data moving between CPU and GPU is encrypted, and the GPU produces its own attestation report. NVIDIA publishes the tooling for setting this up.

Does it slow AI down much? In September 2024 benchmarks on H100 NVL GPUs, throughput overhead was 6.85% for Llama-3.1-8B at batch size 1, 4.58% for Phi-3-14B, and close to zero for Llama-3.1-70B. That works out to under 5% for most typical LLM queries. Time to first token rose more, by about 19% for the 8B model, because the extra encryption work hits short jobs hardest.

Who Uses Confidential Computing and Why

The pattern is the same across industries. A business has data it cannot share in the clear, but it still needs to compute on it, often on someone else’s hardware.

• Banks and payment firms: They run fraud and anti-money-laundering models on transaction data, sometimes pooled across institutions, without exposing one bank’s customers to another.
• Healthcare and life sciences: Researchers can train or test models on patient records while keeping the raw data sealed from the cloud host.
• AI companies: Model owners can serve a model without handing the weights to the operator, and users can send prompts that the operator cannot read.
• Key and wallet management: Signing keys for payments or digital assets can live inside an enclave, so a hacked host still cannot copy them.
• Regulated public sector work: Agencies can use public cloud capacity while showing that the provider has no technical path to the data.

If your company is still building basic defenses, start there first. Confidential computing protects one specific gap, and our small business cybersecurity checklist covers the controls that stop far more common attacks, such as stolen passwords and phishing.

Where Confidential Computing Falls Short

The main claim vendors make is protection from the cloud operator. That claim has limits, and a careful buyer should know them.

In October 2025, researchers from Georgia Tech and Purdue showed an attack called TEE.fail. They placed a device on the DDR5 memory bus of a server and pulled signing keys out of Intel SGX and TDX and an OpenSSL key out of an AMD SEV-SNP VM, using equipment that cost under $1,000. They also forged attestation reports.

The attack needs physical access to the server and root privileges, so it is not a remote threat to an ordinary user. Intel and NVIDIA said they were working on mitigations. AMD said physical attacks of this kind are outside the scope of its design. For buyers, the lesson is plain: today’s TEEs protect well against remote and software attackers, and against curious insiders without hands on the hardware. They are weaker against someone who can open the server case.

Other limits are more ordinary:

• Side channels: Timing and cache tricks have hit enclaves before, and new ones keep appearing. Patches and microcode updates matter.
• Your own code is still in scope: A bug inside the TEE leaks data just as it would outside. The hardware cannot fix a vulnerable app.
• Attestation is easy to skip: A confidential VM that never verifies its report before receiving keys gives much weaker protection. Many early projects stop at turning the feature on.
• Debugging is harder: Teams lose some of the usual tools, such as memory dumps, because the whole point is that nobody outside can see memory.

Confidential Computing Compared with Other Privacy Tools

Confidential computing is one of several ways to compute on sensitive data. The others trade speed for stronger math-based guarantees.

Many real systems combine these tools. A TEE can run a model while differential privacy limits what the published results reveal. Teams that are planning for the next wave of cryptography changes should also read our guide to preparing for post-quantum encryption, because the keys that attestation relies on will need the same upgrade path.

How to Start a Confidential Computing Pilot

A first project does not need a big budget. It needs a clear threat model and one workload that is worth protecting. This order of work keeps the pilot small and useful.

1. Write down who you are protecting the data from. If the answer is other tenants and outside attackers, a confidential VM may be enough. If it includes the cloud operator, you need attestation with a key service you control.
2. Pick one workload. Good first choices are a key-signing service, a scoring model on customer data, or an AI inference endpoint that handles private prompts.
3. Choose the hardware to match. Confidential VMs on AMD SEV-SNP or Intel TDX let you move an existing app with few changes. An enclave design suits a small, high-value function.
4. Wire up attestation before go-live. Make the key service check the report and refuse to release secrets on a mismatch. Test that refusal on purpose.
5. Measure the overhead. Run the same job inside and outside the TEE and compare latency and cost, as the GPU study above did.
6. Write the policy. Decide who may approve a new measurement when you update the code. That approval step is now part of your release process.

If the workload involves AI, pair the pilot with a written AI acceptable use policy so staff know which data may go into which models. And if your team is weighing where sensitive processing should live, our explainer on edge computing applications by industry covers the cases where data never leaves the site at all.

The Companies Building the Hardware

Confidential computing rests on a small number of chip designs. AMD brought memory encryption to its EPYC server chips, and the company’s direction under its chief executive is covered in our Lisa Su CEO spotlight. Intel offers SGX enclaves and TDX trust domains on Xeon. Arm defines CCA for chips built on its designs, and NVIDIA extends the boundary to GPUs.

The clouds turn that silicon into products. Their spending on AI data centers, covered in our reports on Microsoft’s Azure capital spending and Google Cloud’s revenue growth, is one reason confidential GPU options have spread so quickly. Customers who send private data into shared AI hardware want proof of where it goes.

Questions Buyers Ask About Confidential Computing

Is Confidential Computing the Same as Encryption?

It uses encryption, but it covers a different moment. Normal encryption protects stored data and data moving across a network. Confidential computing keeps data encrypted in memory while a program uses it, and it adds attestation so you can check what is running before you hand over keys.

Does Confidential Computing Slow Down Applications?

Usually by a small amount. The memory encryption runs in hardware. GPU benchmarks show throughput overhead under 7% on average for LLM inference, though time to first token for small models rose more.

Can the Cloud Provider Still See My Data?

The design goal is that it cannot, as long as attestation is used and the keys are held by a service the provider cannot change. Physical attacks on the server, such as TEE.fail, are the main known exception, and they need hands-on access to the machine.

Is Confidential Computing Expensive?

Not on its own. On Google Cloud, our math shows $24.67 to $49.15 a month in surcharge for an 8 vCPU, 32 GiB VM, and AWS charges nothing extra for Nitro Enclaves. The bigger cost is engineering time to set up attestation correctly.

Do I Need to Rewrite My Software?

For confidential VMs, usually not, because the whole operating system runs inside the protected VM. Enclave designs such as Intel SGX or Nitro Enclaves need the sensitive part of the app split out and adapted.

Provider and Research Pages Behind This Explainer

• Microsoft Learn: What Is Confidential Computing, with the Confidential Computing Consortium definition.
• Microsoft Learn: Azure Confidential VM Options.
• Google Cloud: Confidential VM Pricing, rates used in our calculation.
• AWS: Nitro Enclaves FAQ.
• Arm: Arm CCA announcement.
• NVIDIA: Trusted Computing Solutions documentation.
• Zhu, Yin, Deng and Zhou: Confidential Computing on NVIDIA H100 GPU, arXiv, September 2024.
• BleepingComputer: TEE.fail attack report, October 28, 2025.