The tension between enterprise AI adoption and data protection has reached a critical juncture. Companies require access to advanced models for processing confidential information—patient records, financial data, proprietary research—yet sending such material to cloud services introduces unacceptable risks. Meanwhile, model developers guard their weights and algorithms as valuable assets, unwilling to expose them in customer-controlled environments where they could be compromised or copied.
This standoff reflects a deeper problem: neither party can fully trust the other. Organizations cannot guarantee that a model will properly redact personally identifiable information or prevent data leakage, even when explicitly instructed to do so. Model builders cannot ensure their intellectual property remains protected once deployed outside their infrastructure. The result is a fundamental gap in control and accountability that slows enterprise AI deployment in regulated industries and data-sensitive sectors.
Alon Horev, CTO and co-founder of AI operating system company VAST Data, frames the challenge this way: Even if you ask the model today to obfuscate a conversation or redact PII from a conversation, it's hard to have 100% confidence that's the case, and that it worked. A customer support agent handling personal profiles must protect information from exposure to other customers while managing whether conversations can be retained for training. The organization ultimately bears responsibility for any breach or mishandling.
Confidential AI architectures: solving a two-sided trust problem
Confidential computing offers a technical path through this impasse. The approach combines encryption at rest and in transit with hardware-isolated execution environments that create protected enclaves. Data and model weights remain encrypted until released to an approved workload, with cryptographic attestation verifying the hardware, virtual machine, software, and configuration before releasing decryption keys.
The architecture preserves independence through separate key control. The enterprise retains keys governing its data; the model builder retains keys governing its model. During workload execution, the infrastructure operator controls neither set. This separation becomes increasingly important as AI systems grow more agentic and autonomous, requiring access to more data and systems with less human oversight.
Horev emphasizes the urgency: This world of agentic AI is moving extremely fast, and we need to limit what an agent can see and do. Organizations unable to establish strong privacy and governance controls for current models will face even greater challenges deploying autonomous agents safely.
From architecture to ecosystem
Translating confidential AI from architectural concept into deployable systems requires coordinating multiple layers. VAST Data launched DataEnclave on September 22 as a capability within its AI Operating System, designed to bring model, application, and data platform together under customer-controlled conditions. The system protects both the enterprise's data and the model builder's weights while allowing each party to maintain control of its own keys.
Building this ecosystem demands partnerships across the stack. VAST Data is working with model providers including Cohere, Deepgram, Factory, Fundamental, and TwelveLabs, alongside infrastructure and security vendors such as Nvidia, CrowdStrike, Fortanix, Nscale, Cisco, and Supermicro. Confidential AI requires more than a protected GPU; it demands models, applications, accelerated hardware, data infrastructure, and operational support functioning as an integrated system.
Customer-controlled infrastructure also reshapes economics. Cloud-based models generate unpredictable costs as token consumption fluctuates with usage patterns, agent loops, and model architecture. On-premises deployment provides a defined capacity and cost base tied to owned or budgeted GPU clusters. The infrastructure itself imposes a natural throughput ceiling, helping organizations understand their workload capacity. Model providers can then price by token, task, or license while enterprises gain visibility into total operating cost, avoiding inefficient model choices or uncontrolled agent activity to generate an open-ended token bill.
Why the data platform is paramount
Confidential AI protects data and model weights during inference, but production AI systems are dynamic environments where information moves constantly between storage, databases, GPUs, networks, applications, and agents. Bolting confidential computing onto a fragmented stack leaves vulnerabilities. Instead, organizations must protect the model, data, and connecting infrastructure as a unified system, with clear accountability for rapidly patching compromised components.
Operability and observability become production requirements. As AI infrastructure grows more distributed, diagnosing failures becomes harder. Horev advocates for a single pane of glass across storage, networking, and compute, enabling teams to see what's happening and maintain low resolution times. An agent investigating an intermittently failing network port in a data center could identify root causes if given access to operational data and tightly controlled permissions governing which infrastructure it can inspect, what data it can retrieve, and what actions it can take.
Monitoring AI workloads requires visibility into performance, failures, and access patterns without exposing customer data or model weights. Agent sandboxes limit which systems and tools an agent can reach, while data platform observability logs what data was accessed, how it was used, and how the agent interacted with downstream systems. Evaluation becomes part of production discipline: teams must observe systems, measure behavior, govern access, and manage change in ways that demonstrate progress. Confidentiality, data-level policy, observability, and correctness must work together.
The emerging ecosystem reflects growing demand for models that run securely under customer control wherever sensitive data resides. These are living systems, according to Horev, not merely features embedded in broader platforms but complete operational environments requiring ongoing management and evolution.