Enterprise AI adoption keeps running into the same wall: the moment sensitive data, model weights, or agent memory leave a tightly controlled environment, security teams lose visibility into what happens to them while the workload is actually running.
Confidential computing exists to close that gap, and new research from ABI Research shows the technology has matured enough, across CPUs, GPUs, containers, and now agentic AI, to become a foundational requirement for enterprises building sovereign AI infrastructure: computing environments they control end to end rather than simply rent.
Protection is Moving From CPUs to GPUs
ABI Research finds that CPU-based confidential computing is closest to mass-market adoption, the product of years spent hardening chip-level isolation for general workloads.
GPU-based confidential computing is now generating the strongest momentum, and for good reason.
It addresses one of the largest unresolved gaps in AI security: protecting data and models while inference and training are actively running, not just while they sit at rest or move across a network.
For any enterprise treating its models and training data as strategic assets rather than commodity inputs, that distinction separates defensible infrastructure from infrastructure that merely looks secure on a vendor slide.
Containers Add a Second Layer of Control
Alongside confidential virtual machines, ABI Research reports rising enterprise interest in confidential containers.
The driver is straightforward: organizations running cloud-native and Kubernetes-based environments want lower operational complexity and a smaller attack surface without abandoning the deployment patterns their engineering teams already rely on.
This matters as much for IT policy as for architecture.
It lets security organizations extend confidentiality guarantees into environments built for speed rather than isolation, closing a compliance gap that has slowed AI adoption across regulated industries such as financial services, healthcare, and government contracting.
Vendor Landscape is Consolidating Around Trust
NVIDIA continues to set the pace on confidential GPUs, extending protections across its Hopper, Blackwell, and Vera Rubin platforms, while Intel, AMD, and Arm are strengthening the CPU and heterogeneous compute foundations that broader Confidential AI deployment requires.
On the software side, ABI Research points to Anjuna, Red Hat, Fortanix, Decentriq, and IBM as the vendors building attestation tooling, model-weight protection, and confidential-container controls.
For enterprise IT buyers, this means vendor selection now runs through security architecture as much as through AI model benchmarks, a shift many procurement teams have been slow to make.
Why Agentic AI is the Real Governance Test
Agentic AI systems raise the stakes considerably. An agent that executes autonomously, carries memory across sessions, and takes action on an enterprise's behalf creates a different risk profile than a model that answers a single prompt.
As ABI Research senior analyst Aisling Dawson puts it, agentic AI is creating a new security inflection point for the confidential computing market.
Confidential computing will not resolve every risk that agentic AI introduces, but it is emerging as one of the most credible hardware-rooted approaches to securing agent execution, protecting the memory agents carry between actions, and building the auditability that boards and regulators are beginning to expect as standard practice.
Outlook for Secure AI Infrastructure Demand
The enterprises that treat confidential computing as a procurement requirement now, ahead of the next wave of agentic AI deployments, will be negotiating from a position of strength.
Those that wait will be retrofitting security into systems already running production workloads, which is precisely where audit findings and breach post-mortems tend to originate.
CIOs and CISOs should require attestation reporting from every AI infrastructure vendor under consideration, treat GPU-level confidentiality as a baseline for any workload touching regulated or proprietary data, and write agent governance policies that assume the agent itself, not just the underlying model, needs its own security boundary.
The AI vendors pairing strong attestation with real performance and genuine ecosystem cooperation will set the terms that competitors are eventually forced to match. The question worth asking in the next vendor review is not how fast the AI model runs. It is whether anyone can reliably prove what happened to the organization's valuable data.