In high-stakes AI deployments, the real value often lies not in the data but in the trained models that result from it. According to Jay Krishnan, these models encapsulate a company’s competitive logic: pricing strategy, fraud signals, and business intelligence buried deep inside weight matrices and hyperparameters.
“Everyone talks about data privacy,” Jay Krishnan says. “But what’s often overlooked is that the model itself is now the intellectual property worth stealing.”
With over two decades of experience designing platforms for banks, telecoms, and public-sector agencies across the Middle East, Jay Krishnan has seen this shift firsthand. Many of his clients want the scalability and speed of cloud GPUs but must also convince regulators that no sensitive model artifacts can leak, especially in regulated industries. This is where confidential computing becomes essential.
Leaders like the General Manager – AI & Cybersecurity at NAIB IT Consultancy W.L.L, operating across Dubai and Bahrain, are among those advancing secure AI adoption in compliance-heavy environments. Their push for cloud-native but compliant infrastructure is helping set new benchmarks for trustworthy AI deployment.
Why the Model, Not Just the Data, Needs a Vault
Deep-learning models trained on sensitive or proprietary data embed far more than expected. A credit risk model can reveal underwriting thresholds. A claims optimizer might hint at reimbursement policies. If deployed without protection, these models are vulnerable to theft, inversion attacks, or internal misuse.
An IBM Security X-Force report highlights that theft of AI assets rose by 30 percent in regulated sectors last year. The threat is clear: adversaries increasingly target the model, not just the training data.
What SGX and Nitro Enclaves Actually Do
While most discussions gloss over the technical mechanics, Jay Krishnan offers a clear, implementation-level perspective:
“Confidential computing works because it assumes zero trust in the host. Even if someone owns the machine, they can’t see what’s inside the enclave.”
He breaks it down as follows:
- Intel SGX creates a secure enclave inside the CPU, where memory pages are encrypted using a hardware key. The CPU issues an attestation hash before code executes, and decryption keys are released only after verifying this identity.
- AWS Nitro Enclaves achieve similar isolation by carving out a stripped-down VM from the parent EC2 instance. There is no network access or persistent storage. Communication is only allowed through a tightly controlled vsock channel.
In both cases, the decrypted model exists only inside the enclave. There is no exposure in the network, on disk, or in memory that the OS can access.
What Works in the Field
Over the past year, Jay Krishnan’s team applied confidential computing in three major production rollouts, all in sectors where AI inference is tied to regulatory or IP risk. Common patterns emerged:
- Attested model launch – The model artifact is encrypted and stored in S3 or Azure Blob. A control plane checks the enclave hash before releasing keys via short-lived tokens.
- Stateless inference – No data is retained inside the enclave between requests. If compromise is suspected, the instance is shut down and restarted from a clean image.
- Split compute pattern – Preprocessing, such as tokenization or image decoding, runs outside the enclave. Only the forward pass and logic layer execute within the TEE.
- Policy-bound key release – Keys are issued only if the workload runs under specific IAM roles and in allowed regions, preventing “lift-and-shift” attacks.
“That last control, binding key release to workload identity, turns enclave use into enforceable policy,” Jay Krishnan explains.
Trade-offs Every CTO Should Know
Confidential computing introduces some constraints. SGX is limited to around 256 MB of protected memory, and Nitro Enclaves can introduce cold-start latencies up to 45 seconds. Debugging is also slower, and DevSecOps pipelines need new tooling for attestation.
However, Jay Krishnan believes the trade-offs are manageable:
“Our client in financial services estimated a 10% cost premium. After tuning the enclave footprint and moving to Graviton hosts, the actual delta was closer to 6%.”
For models involving pricing, risk, or personal health data, the cost of leakage often outweighs this overhead.
The Road Ahead
Jay Krishnan draws a parallel with the early days of HTTPS:
“TLS was once used only for payments. Now it’s on every page. Confidential computing is heading the same way, especially for AI.”
He points to emerging support in the Open Enclave SDK, confidential containers, and hardware-backed isolation technologies like AMD SEV-SNP as signs that the ecosystem is maturing rapidly.
For technology leaders looking to future-proof their architecture, he offers three priorities:
- Threat-model the model, not just the data.
- Enable SGX or Nitro support early in the CI/CD pipeline.
- Treat enclave design as a product feature, not a delay.
“If we can guarantee that even the cloud provider can’t see inside our models,” Jay concludes, “we enable use cases that were previously impossible—secure federation, cross-border training, and high-value inference in shared environments.”
Executives like those at NAIB IT Consultancy W.L.L are already aligning with this next-generation thinking to safeguard mission-critical AI IP while staying regulator-compliant.
For CTOs balancing innovation and risk, confidential computing is no longer an academic curiosity. It is fast becoming the standard for model integrity in enterprise AI.