Fortanix Confidential AI now supports CNCF Confidential Containers. Here is why that matters for enterprises building on Cisco Secure AI Factory with NVIDIA, and how it fits a full-stack approach to trusted AI.
The AI use cases with the most value tend to sit on the most sensitive data. A bank wants models working on transaction records. A hospital wants insight from clinical data. A government agency wants AI on information that can never leave its jurisdiction. For these organizations, the question is no longer whether AI works. It is whether they can verify that protections are in place for their data and the models working on it while AI is running.
That is harder than it sounds. Encryption protects data at rest and in transit, but during inference, model weights and data are decrypted in CPU and GPU memory, where privileged administrators, infrastructure operators or anyone with access to the host could reach them. New research from Fortanix and Atomik Research puts numbers on the gap: 93% of AI leaders understand that traditional encryption does not protect data while AI is processing it, yet only half can fully verify that protection is in place during inference.
Three parties sit in that equation, and each needs something different. The enterprise needs to keep control of its data. The model owner needs to protect the weights and IP it spent years building. And the operator running the infrastructure, whether an internal IT team, a neocloud or a sovereign cloud, should not be able to see either one.
From open source to production-grade confidential AI
This week, Fortanix announced support for CNCF Confidential Containers (CoCo) in Fortanix Confidential AI. CoCo already lets Kubernetes AI workloads run inside hardware-based Trusted Execution Environments (TEEs) on confidential CPUs and GPUs. Fortanix adds what production teams need on top of it: open-source plugins contributed to CoCo that connect Fortanix Confidential Computing Manager (CCM) for attestation and Fortanix Data Security Manager (DSM) for secure key release, working within CoCo’s standard workflows.
The principle is simple: verify before you decrypt. Before any key is released, CCM checks that each container is genuine, runs inside a TEE and meets security policy. Because the CPU and GPU are verified together through composite attestation, trust covers the full execution path. Keys stay in DSM, a FIPS 140-2 Level 3 HSM and key management solution, and are released only into the verified environment. If the measurements do not match policy, the keys stay locked and the workload cannot decrypt.
For the people building AI, the practical benefit is that the Kubernetes workflow does not have to change. Developers keep the speed of containers. Security teams get cryptographic evidence instead of an operator’s assurance. And because Fortanix Confidential AI deploys as SaaS, on premises or fully air-gapped, regulated and disconnected environments can adopt it without depending on the cloud.
“The challenge with enterprise AI isn’t just getting models running. It’s building an architecture that lets organizations use their most important data securely, wherever AI is running,” said Jeremy Foster, Senior Vice President and General Manager, Cisco Compute. “Cisco believes security has to be designed into the AI infrastructure from the start, across compute, networking, data, applications and the workloads themselves. Confidential computing adds an important layer by protecting data and models while they’re actively being used, helping enterprises move AI into production with greater confidence.”
One trust layer from the data platform to Kubernetes
This builds on work we shared a few weeks ago. In Building a trusted foundation for confidential AI, Jawwad Memon described how Cisco and VAST Data help organizations bring advanced models to the infrastructure where sensitive data already lives, using VAST DataEnclave, the confidential AI capability within the VAST DataEngine. Fortanix built the attestation and key management layer integrated into DataEnclave.
That gives customers two entry points with one consistent trust model. Teams that want confidential AI built into the data platform can run models next to their data with VAST DataEnclave. Teams that build and operate their own AI applications and agents on Kubernetes can use Fortanix Confidential AI with CoCo. In both cases, Fortanix attestation and key release decide when a model or dataset can be unlocked, so security and compliance teams work from the same controls and the same evidence.
Model owners gain as much as enterprises do. A frontier AI lab can make a proprietary model available on premises or in an air-gapped site, next to a customer’s most sensitive data, with decryption tied to an attested environment it approved. The customer keeps its data. The model owner keeps its IP. Neither is exposed to the other or to the infrastructure provider.
Why Cisco: confidential AI is a full-stack concern
A TEE protects a workload in memory. A production AI system needs much more. Data has to move between GPUs, storage and services. Policies have to be enforced across the network. Models and applications face their own threats. And operations teams need enough visibility to run the system without breaking the isolation it depends on. That is why Cisco treats confidential AI as part of Cisco Secure AI Factory with NVIDIA, where compute, networking, data, security and observability are designed to work together:
- Compute: Cisco UCS servers combine hardware roots of trust, secure boot and platform attestation with support for confidential computing technologies including Intel TDX, AMD SEV-SNP and NVIDIA Confidential Computing, managed through Cisco Intersight.
- Networking: High-performance networking built on Cisco Silicon One or NVIDIA Spectrum-X™ Ethernet networking moves data predictably between compute, storage and accelerated computing and Cisco Hybrid Mesh Firewall extends policy enforcement to NVIDIA BlueField™ DPUs.
- Data: VAST Data provides the AI data platform, and DataEnclave adds a confidential runtime and attestation for models working on sensitive data, eliminating performance hurdles.
- AI security: Cisco AI Defense helps address risks across AI models, applications and agents, complementing the runtime protection confidential computing provides.
- Observability and operations: Splunk and Isovalent provide visibility across applications, infrastructure, networks and cloud-native environments, alongside auditable records of attestation and policy decisions. Cisco Cloud Control is designed to give teams one place to manage and monitor networking, security, compute and observability.
Fortanix brings the trust layer into that stack as part of the Cisco Secure AI Factory with NVIDIA ecosystem, so customers can choose the building blocks they need without stitching the security model together themselves.
What this means for the teams running AI
Confidential AI only matters if it changes what organizations can actually do. Here is what it opens up:
- Enterprises in regulated industries can apply frontier models to sensitive and sovereign data on infrastructure they control, instead of sending that data to an outside service.
- Model owners can reach customers in on-premises, sovereign and air-gapped environments while keeping decryption tied to approved, attested environments.
- Neocloud and sovereign cloud operators can host AI services for sensitive workloads without gaining visibility into customer data or models.
- Platform and developer teams can keep standard Kubernetes and CoCo workflows rather than building the trust layer themselves.
- Security and compliance leaders get cryptographic evidence of what ran, where and under which policy, which they can bring to auditors and regulators.
See it at GTC Berlin
At NVIDIA GTC Berlin, October 20-22, 2026, Cisco and Fortanix will show the full flow from protected model to attested inference on Cisco Secure AI Factory with NVIDIA accelerated computing. Visit Fortanix at booth 7017 for the live demo and the Cisco booth, number number 3032. Here is what you will see:
- Protect the model: The model owner packages the model as an encrypted image, with keys under its control in Fortanix DSM.
- Deploy: The enterprise runs the workload on a confidential VM or through CoCo with Kata Containers on its AI infrastructure.
- Verify: Fortanix CCM checks composite attestation evidence for the CPU, GPU and software environment.
- Run: After successful attestation, DSM releases keys into the verified TEE, and the model serves prompts and responses inside the protected boundary.
- Enforce: If the image, configuration or measurements change, or access is revoked, key release fails and the workload cannot decrypt or start.
To go deeper on the architecture, read the new Cisco and Fortanix design guide.
The organizations with the most to gain from AI are often the ones that can least afford to lose control of their data. With Cisco, Fortanix, VAST Data and NVIDIA, they can bring powerful models to that data and verify that protections are in place.
