The systems we trust to protect our most sensitive payment and personal data such as encryption libraries, tokenization engines, key management services, blockchain validators, identity providers, and data-protection SDKs are themselves the highest-value attack targets in the enterprise. They hold the keys. They see plaintext. They sign transactions. Compromise one of them, and every dataset they protect falls with them.
We have spent two decades hardening and segmenting the perimeters around these systems. We have not done the same for the memory and live processors they run in. Yet, that's where attacks can, and do, happen.
Every cryptographic operation eventually happens in random access memory (RAM). Keys are unwrapped from the hardware security module (HSM), cached for performance, loaded into the address space of an application, and operated on alongside live plaintext. Anyone with privileged access to that host such as a rogue admin, a stolen service account, an attacker who has chained their way to root, an infrastructure operator, a hypervisor, or an AI-orchestrated intrusion can read it. The HSM does not help once the key is in use. Neither does post-quantum cryptography. A 4096-bit lattice key in vulnerable memory is still a key in vulnerable memory.
This is not theoretical. It is the dominant pattern in modern nation-state breaches.
The Pattern Is Already Established
- SolarWinds (2020). Russia's Foreign Intelligence Service (SVR) planted SUNBURST in Orion monitoring code, pivoted into victim environments, and stole Security Assertion Markup Language (SAML) token-signing keys directly from memory. With those keys they forged authentication tokens and walked into the US Treasury, Commerce, Department of Homeland Security, and dozens of Fortune 500 networks. The HSM was not the problem. The memory was.
- Microsoft Storm-0558 (2023). A Chinese advanced persistent threat (APT) obtained a Microsoft consumer signing key that had been improperly captured in a crash dump. They used it to forge Exchange Online tokens and read the email of the US Secretary of Commerce, the US Ambassador to China, and other senior officials. A guardian key, in the wrong memory region, at the wrong moment.
- Salt Typhoon (2024). Chinese state actors compromised at least nine US telecom carriers and, by the FBI's own account, accessed the lawful-intercept systems used by US law enforcement. The watchers were watched. The guardians were read.
- Target (2013). RAM-scraping malware on point-of-sale terminals harvested 40 million card numbers and 70 million customer records in real time. More than a decade later, the technique still works, because the underlying assumption has not changed: trust the OS, trust the kernel, trust the admin. The fact is, hope isn't trust. Trust must be proven and earned.
In every case, the attacker did not break the cryptography. They just read data right out of memory.
The Turtle Has to Stop Somewhere
For 30 years, the answer to “how do we protect this?” has been to add another layer of software. Another agent. Another proxy. Another vault wrapping the vault. Each layer assumes the one beneath it is honest. None of them survive a privileged attacker. An AI-driven adversary that can chain exploits, mimic admin behavior, and probe at machine speed is, definitionally, a privileged attacker waiting to happen.
The buck has to stop somewhere, and software cannot be where it stops. The hardware has to be where it stops.
Confidential Computing Is the Floor
Confidential computing through Intel TDX, AMD SEV-SNP, ARM CCA, NVIDIA confidential GPUs moves the trust boundary down to the silicon. The trust boundary is below the OS, below the hypervisor, and designed for isolation. Instead of operating in vulnerable memory, critical services run inside hardware-enforced enclaves. Memory is encrypted with keys exclusive to the secure CPU itself. The host OS, the hypervisor, the cloud provider, and the domain admin cannot read it. Remote attestation proves the code running inside is the code you signed and the workload you authorized, not a tampered binary, not an injected agent, not an AI-spawned variant.
Results? A SolarWinds-style memory dump returns ciphertext. A Storm-0558-style crash dump contains nothing usable. A Salt Typhoon-style privileged foothold sees an opaque box. The attacker still has the host, but they no longer have the keys, the code, or the data. A sophisticated attack means nothing — and provably so.
What CISOs Should Be Asking
Ask one question of every team that operates a cryptographic, tokenization, signing, identity, or data-protection service:
When the data security systems and keys are in use by applications, who or what can access the memory they are in?
If the answer involves trusting an OS, a hypervisor, an administrator, or a cloud operator, the system is not protected. It is asserted to be protected, but that assertion does not hold against a determined nation-state actor, and it will not hold against the AI-driven attack tooling already in the wild.
The guardians need a guardian. The only guardian that holds under that pressure is the silicon.
If you'd like to learn how leading payment companies, banks, and fintechs are embracing confidential computing to guard the guardians by securing the systems that secure your data and code, we'd be more than happy to show you how. Let us know.