All analysis was generated autonomously, without human review. Scores are analytical opinions drawn from the cited public sources, without hands-on testing. They are not audits, certifications, investment reports, purchasing advice, or evaluations of quality.
This analysis is scoped to Fortanix Confidential AI.
Fortanix sells Confidential AI, software that runs AI workloads in encrypted memory on Intel and NVIDIA chips so data and models stay inaccessible to the host. It targets healthcare, finance, and government buyers, and model developers deploying models at customer sites without risking model theft. Founded in 2016, it raised a $90 million Series C in 2022 led by Goldman Sachs, for over $122 million in total. It counted dozens of Fortune 500 companies and several U.S. government agencies as customers in 2022 and names Deepgram, a voice AI company, as a Confidential AI customer. Its software stores customer encryption keys and releases them only after verifying what is running. A departing customer would likely have to rework that key storage and any models it packaged for the product.
| Description | Fortanix is a data-security company whose Confidential AI runs enterprise models and inference on confidential-computing infrastructure that keeps data and model IP inaccessible to the underlying infrastructure, alongside its key management and hardware security module products. | [f1] |
|---|---|---|
| Founded | 2016 | [f2] |
| HQ | Santa Clara, California, US | [f3] |
| Funding | $122M total | [f4] |
| Latest funding | Series C, $90M (2022) | [f4] |
| Product | What it does |
|---|---|
| Fortanix Confidential AI | Confidential-computing runtime that runs enterprise models and inference inside trusted execution environments so model IP and data stay encrypted and inaccessible to the host. |
| Confidential Computing Manager | Control plane that registers nodes and manages trusted execution environments, verifying workloads through composite CPU and GPU attestation before keys are released. |
| Armet AI | Turnkey secure generative AI platform that runs the full AI pipeline on confidential computing with built-in orchestration, observability, and guardrails. |
| Data Security Manager | Enterprise encryption and key management with a FIPS 140-2 Level 3 hardware security module and key management service across hybrid multicloud environments. |
| Key Insight | Cryptographic security posture management that discovers encryption keys and data services, flags at-risk and quantum-vulnerable keys, and prioritizes remediation. |
AI Defense Matrix
| Govern | Identify | Protect | Detect | Respond | Recover | |
|---|---|---|---|---|---|---|
| AI-Workload Platforms Inference servers, training platforms, vector DB platforms, and the model-loading supply chain. | ||||||
| AI Coding and Orchestration Tools AI coding tools and agentic orchestration tools on user devices, plus their plugins, skills, hooks, system prompts, scaffolding, harnesses, configuration settings, and MCP clients. | ||||||
| AI-Generated Code Code produced by AI tools, AI-assisted reviews, AI-generated infrastructure-as-code and tests, and vibe-coded apps that bypass CI/CD. | ||||||
| AI Traffic Paths to external and self-hosted AI services, MCP tool channels, agent-to-agent calls, model-registry downloads, and egress to unapproved AI services. AI gateways, LLM routers, and MCP gateways steer traffic along those paths. The steering decisions and their inputs belong here too: routing policies, MCP server registries, and agent naming and discovery services. | ||||||
| AI Model Model weights, fine-tuning checkpoints, model cards, registries, an AI bill of materials (AIBOM), and the third-party LLMs your enterprise consumes. | ||||||
| Training Data Datasets used for training, fine-tuning, and continued learning. | ||||||
| Runtime AI Data User prompts, inference inputs, RAG content, vector DB content, persistent agent memory, and interaction history. | ||||||
| AI Agent Identities AI agents as non-human principals, plus credentials, keys, permission scopes, service accounts, and delegation chains across agents and tools. |
Fortanix Confidential AI runs proprietary models inside a confidential-computing trusted execution environment so model IP and inference data stay encrypted and inaccessible to the host and cloud operator across the AI lifecycle. These capabilities are mapped to the AI Defense Matrix. [f5]
How well the company can compete in its security market, scored across eight dimensions against public evidence.
| Dimension | Score | Rationale |
|---|---|---|
| Problem Clarity How precisely the company defines its problem, with evidence the problem exists at the scale claimed. | 3/5 | Fortanix names two buyer problems for the line. Regulated organizations want AI on data too sensitive to expose, and model owners must protect their weights inside customer environments. SiliconANGLE’s report on the NVIDIA joint solution and the TELUS and Deepgram announcements describe the same concerns. No independent study or named mandate in the reviewed sources quantifies them, so the pain is described rather than measured. [s9, s20, s17, s18, s23] |
| Capability Depth How specific the technical capabilities are, with evidence beyond marketing claims such as docs and third-party validation. | 4/5 | Fortanix documents composite CPU and GPU attestation through Confidential Computing Manager and NVIDIA’s NRAS service, followed by key release from Data Security Manager only after attestation succeeds. Outside Fortanix’s pages, NAND Research describes the Intel SGX and TDX layers behind Armet AI. Deepgram’s own release describes running its voice models with Fortanix Confidential AI on confidential-computing GPUs. [s1, s2, s8, s23] |
| Market Timing Whether the market is ready for this product, with evidence that buyers are actively seeking solutions. | 3/5 | The enabler is confidential computing on GPUs and CPUs, and the line runs on NVIDIA Hopper and Blackwell GPUs and Intel SGX and TDX processors. Fortanix opened an Armet AI public preview in April 2025, announced and demonstrated the NVIDIA joint solution in October 2025, and released Confidential AI for model owners as available immediately in March 2026. The buyer-side signals on record are adoption announcements from TELUS in March 2026 and Deepgram in June 2026, a single kind of signal. [s2, s7, s9, s17, s18, s23] |
| Team Credibility Demonstrated domain expertise with public signals such as prior exits, publications, and industry recognition. | 3/5 | Anand Kashyap co-founded Fortanix in 2016 and leads it as CEO after scaling it as CTO. TechCrunch reported his earlier role as a principal security researcher at Symantec. Fortanix credits CTO Jethro Beekman with its architecture since the founding. That is verifiable senior in-domain experience, and the patent and publication totals are the company’s own figures. [s5, s16, s7] |
| GTM Proof Evidence of actual traction (customers, revenue signals, partnerships) beyond stated intentions. | 3/5 | Fortanix presents Deepgram as a Confidential AI customer in a case study, and Deepgram’s own June 2026 release describes running its voice models on the product. SiliconANGLE quotes NVIDIA’s vice president of enterprise AI products on the October 2025 joint solution, and Telecompaper reports the March 2026 TELUS partnership. The cited sources document named references and partnerships for the line and contain no line-specific customer count or revenue, which places it at named references without independent corroboration of scale. [s27, s23, s9, s19, s18] |
| Funding Efficiency Whether funding matches go-to-market ambition, with signs of capital-efficient growth. | 3/5 | At line scope, Fortanix shows visible shipping: an Armet AI public preview in April 2025, the NVIDIA joint solution announced in October 2025, and a Confidential AI release announced as available immediately in March 2026. The company’s latest disclosed raise is a $90 million Series C in 2022 led by Goldman Sachs, for over $122 million in total. Fortanix discloses no revenue or margin, so efficiency is unconfirmed. [s7, s9, s17, s4, s5] |
| Category Clarity Whether the company creates or fits a recognizable category that buyers can quickly place in their stack. | 3/5 | Confidential computing is a recognizable category, and TechCrunch and Futuriom placed Fortanix in it in 2022. Confidential AI extends that category to model and inference protection. Fortanix, TELUS, and Deepgram each explain in their announcements what the extension adds, which fits a nascent category. [s5, s6, s17, s18, s23] |
| Incumbent Defensibility How vulnerable the core value proposition is to absorption as a feature by a platform vendor. | 3/5 | Fortanix adds attestation through Confidential Computing Manager and key release from Data Security Manager in FIPS 140-2 Level 3 hardware. A platform vendor would have to reproduce both to replace the line. Intel and NVIDIA make the underlying hardware, and Futuriom reported in 2022 that the cloud hyperscalers were active in confidential computing. That evidence supports friction to absorption without a documented structural moat. [s2, s1, s6, s9] |
Fortanix Confidential AI addresses organizations that want to run AI on data too sensitive to expose to the infrastructure beneath it. SiliconANGLE’s report on the 2025 NVIDIA joint solution describes healthcare, finance, and government data as too sensitive to move into the cloud without serious risks. The TELUS announcement names the same regulated sectors as the focus of its joint solution.
A second buyer problem belongs to AI model owners. Fortanix describes AI labs that must deploy frontier models where enterprise data lives. Its March 2026 release positions Confidential AI for model developers distributing models into on-premises AI factories without risking theft. Deepgram’s release describes that need for its own voice models.
Partners and press describe both problems in the terms Fortanix uses. [s9, s18, s20, s17, s23]
Fortanix Confidential AI runs AI workloads on confidential CPUs and GPUs that encrypt memory, keeping data, model weights, and inference protected from privileged insiders. The product supports on-premises deployment and the Azure and Google public clouds.
Fortanix protects workloads with two mechanisms. Composite attestation joins Fortanix Confidential Computing Manager and NVIDIA’s NRAS service into one chain of trust across CPU and GPU. Fortanix Data Security Manager then allows access to datasets and model artifacts only after attestation succeeds. It keeps the keys in a FIPS 140-2 Level 3 certified hardware security module.
Armet AI is a turnkey agentic AI platform on the same foundation, with built-in guardrails, observability, and orchestration. It entered public preview in April 2025 on Intel SGX and TDX. For model owners, Fortanix describes packaging model weights inside an encrypted, attested confidential virtual machine image that can be deployed to many enterprises.
Outside Fortanix’s own pages, NAND Research describes the Intel SGX and TDX layers Armet AI builds on. Deepgram’s release describes its voice models running with Fortanix Confidential AI on confidential-computing GPUs, with audio data and model weights encrypted throughout use. [s1, s2, s7, s20, s8, s23]
Fortanix Confidential AI adds attestation and key release to confidential-computing hardware from NVIDIA and Intel. Futuriom reported in 2022 that the cloud hyperscalers and companies such as Accenture, Arm, Meta, and Red Hat were active in confidential computing, so Fortanix meets large platform companies in the category as well as startups.
Among startups, TechCrunch’s 2022 coverage named Opaque Systems, Edgeless Systems, and Decentriq as companies with rival confidential computing solutions.
Fortanix adds its key management on top of that hardware. Data Security Manager keeps keys in FIPS 140-2 Level 3 hardware and releases them only after attestation. That ties the AI line to the key-management business Futuriom described in 2022. [s2, s6, s5, s1]
Fortanix names Deepgram, a voice AI model company, as a Confidential AI customer in a case study. The case study describes Deepgram deploying its proprietary voice models in enterprise environments with the product. Deepgram’s own June 2026 release announces the arrangement as a partnership.
Fortanix’s other announcements for the line are partnerships. SiliconANGLE reported the October 2025 joint solution with NVIDIA and quoted NVIDIA’s vice president of enterprise AI products. Telecompaper reported the March 2026 TELUS partnership, under which the solution will be available through the TELUS Sovereign AI Factory in Canada.
Two further references appear on Fortanix’s pages. ElevenLabs appears through a quote from its forward deployed engineer about working with Fortanix on NVIDIA Confidential Computing-backed infrastructure. The BeeKeeperAI case study, about a healthcare AI developer created at UCSF, lists Data Security Manager and Confidential Computing as the products used.
At company level, Fortanix said in 2022 that it counted dozens of Fortune 500 companies and several U.S. government agencies as customers. [s27, s23, s9, s19, s18, s1, s10, s4]
Fortanix was founded in 2016 by Ambuj Kumar and Anand Kashyap, and Kashyap now leads the company as CEO. Fortanix says he scaled the company first as CTO and later as CEO, and TechCrunch reported his earlier role as a principal security researcher at Symantec.
Fortanix credits Jethro Beekman, its chief technology officer and chief information security officer, with the design and security of its software architecture since the founding. The company describes its team as holding more than 100 security patents and more than 30 papers in top conferences.
Goldman Sachs led the 2022 Series C, with Intel Capital, Foundation Capital, Neotribe Ventures, GiantLeap Capital, and In-Q-Tel also investing. TechCrunch describes In-Q-Tel as the nonprofit strategic investor for the U.S. intelligence community.
The team shows senior in-domain experience sustained over a decade. Independent reporting verifies the founders’ earlier security roles, and the patent and publication totals are the company’s own figures. [s5, s16, s7, s4]
Fortanix Confidential AI builds its trust case on cryptographic controls. Fortanix keeps keys in a FIPS 140-2 Level 3 certified hardware security module with strict key custody and immutable audit logs. Access to data and models requires verified attestation first.
NIST’s Cryptographic Module Validation Program lists certificate #4139 for the Fortanix SDKMS Appliance as active at FIPS 140-2 Level 3, with a September 21, 2026 sunset date. NIST describes that appliance as the building block for Fortanix’s unified hardware security module and key management service.
The National Vulnerability Database records CVE-2023-38021 in Fortanix’s Confidential Computing Manager platform for Intel SGX before version 3.32. Missing pointer-alignment validation allowed a local attacker to access unauthorized information, and the flaw affected the component that verifies environments before key release.
At company level, Fortanix’s trust center page includes SOC, ISO, PCI DSS, FIPS, and CIS under its industry certifications. Fortanix describes itself there as an inaugural member of the Confidential Computing Consortium. [s1, s2, s11, s12, s26]
| Company | Relationship | Note | Compare |
|---|---|---|---|
| Opaque Systems | competes with | TechCrunch named Opaque Systems in 2022 among startups with rival confidential computing solutions. | N/AWe scored these companies at different scopes, so the totals measure different things. |
| Tinfoil | competes with | N/AWe scored these companies at different scopes, so the totals measure different things. | |
| Anjuna Security | competes with | N/AWe scored these companies at different scopes, so the totals measure different things. | |
| Enveil | adjacent | N/AWe scored these companies at different scopes, so the totals measure different things. | |
| Duality Technologies | adjacent | N/AWe scored these companies at different scopes, so the totals measure different things. |
Add analyzed competitors to compare them side by side with Fortanix.
A closer look at the company's product strategy, measuring how defensible it is against market forces and examining the eight areas behind it.
reinforce or reposition
Fortanix Confidential AI runs on confidential-computing hardware from Intel and NVIDIA, and Fortanix adds attestation and key release on top of that hardware. Data Security Manager keeps keys in FIPS 140-2 Level 3 hardware and releases access to data and models only after an environment proves what software it runs. Fortanix describes no data asset it retains from the customer data and model weights the product protects. A customer that leaves would likely have to rework key management and any encrypted virtual-machine packages containing the models.
| Dimension | Score | Rationale |
|---|---|---|
| Value Delivery Does the product sell software as the product, or judgment, trust, or accountability with software as the delivery mechanism. | 1/3 | Fortanix Confidential AI delivers software: Confidential Computing Manager for attestation, Data Security Manager for key release, and Armet AI for orchestration. The customer or a partner runs it on confidential-computing hardware, which is the software-product level. |
| Switching Cost How expensive leaving is for a customer: data portability, integrations, learned workflows, network effects, regulatory data residency. | 2/3 | Fortanix keeps keys under strict custody in FIPS 140-2 Level 3 hardware and releases them only after attestation. Model owners package weights inside encrypted, attested images. A customer that leaves would likely have to rework that key custody and packaging, and the cited record neither describes nor sizes that exit. |
| Compliance Moat Whether certifications, liability acceptance, or audit trails block an easy replacement. | 2/3 | Fortanix states that key release for the line runs on FIPS 140-2 Level 3 certified hardware. NIST lists an active Level 3 validation for the Fortanix SDKMS Appliance with a September 21, 2026 sunset date. For deployments requiring FIPS validation, a rival could use a validated module or validate a new one. |
| Problem Complexity Whether the product requires ML, optimization, real-time systems, or years of specialized expertise. | 3/3 | Joining CPU and GPU attestation into one chain of trust and releasing keys only to verified environments is hardware security and cryptography engineering. NAND Research describes the Intel SGX and TDX layers behind Armet AI. |
| Buyer Profile Whether buyers are SMB operators, mid-market IT teams, or regulated enterprises and governments with procurement gates. | 2/3 | The line’s customer and partner references are AI model owners and infrastructure operators. Fortanix presents Deepgram, a voice AI model company, as a customer, and TELUS offers the solution through its sovereign AI factory. Healthcare, finance, and government organizations appear in these announcements as the sectors the solutions target, and the Fortune 500 companies and U.S. government agencies Fortanix reported as customers in 2022 describe its company-wide roster. |
| Layer Whether the product is an end-user application, a platform with application features, or infrastructure other applications depend on. | 3/3 | AI workloads run inside the attested environments Fortanix Confidential AI creates, and Data Security Manager releases keys only after attestation. That makes the product execution infrastructure that other AI software depends on. |
| Proprietary Data, Content, or IP Whether the product accumulates datasets, content licenses, or IP that a rival cannot recreate from scratch. | 1/3 | The product protects customer data and model owners’ intellectual property from the underlying infrastructure, and the cited record describes no asset that accrues to Fortanix. Fortanix’s about page claims more than 100 security patents company-wide. The cited record identifies no granted patent, dataset, or content license tied to the Confidential AI line, so the line holds no evidenced proprietary asset. |
Fortanix Confidential AI serves three kinds of buyer. Healthcare, finance, and government are the regulated sectors SiliconANGLE and the TELUS announcement name. SiliconANGLE describes their data as too sensitive to move into the cloud without serious risks.
AI model owners form the second segment. Fortanix’s AI Labs page pitches deployment of proprietary models where enterprise data lives, and Deepgram is the model company Fortanix names as a customer.
Operators of AI factories and sovereign clouds form the third. TELUS announced that the joint solution will be available through its sovereign AI factory in Canada, and Fortanix’s March 2026 release positions the product for on-premises AI factories.
The core capability is running AI training, fine-tuning, and inference inside trusted execution environments that keep data and model weights protected even from privileged insiders. Composite attestation joins Confidential Computing Manager and NVIDIA’s NRAS service into one chain of trust, and Data Security Manager releases access only after that attestation.
Armet AI adds a turnkey agentic AI platform with built-in guardrails, observability, and orchestration. For model owners, Fortanix packages model weights inside an encrypted, attested confidential virtual machine image that can be deployed to many enterprises.
The AI-specific advantage is the verified protection Fortanix places around whatever model a customer runs. Fortanix builds that protection from attestation and key release on hardware that Intel and NVIDIA supply.
Fortanix takes Confidential AI to market through a named model-owner customer and infrastructure partnerships. Its case study presents Deepgram deploying proprietary voice models with the product, and Deepgram’s own release announces the arrangement.
SiliconANGLE reported the October 2025 NVIDIA joint solution, which Fortanix demonstrated at NVIDIA GTC in Washington. Telecompaper reported the March 2026 TELUS partnership, which offers the solution through the TELUS Sovereign AI Factory.
Fortanix’s pages add an ElevenLabs quote about working with Fortanix on NVIDIA Confidential Computing-backed infrastructure. A BeeKeeperAI case study on the same site lists Data Security Manager and Confidential Computing as the products used.
Fortanix shows no price on the Confidential AI or Armet AI pages. Those pages ask visitors to contact the company, request a demo, or join the Armet AI public preview. That suggests negotiated enterprise pricing.
Deployment options span on-premises data centers, the Azure and Google clouds, and enterprise AI factories, and TELUS offers the joint solution through its own AI factory. What a buyer pays is therefore likely to vary with the infrastructure and channel used.
Fortanix delivers Confidential AI as software: Confidential Computing Manager for attestation, Data Security Manager for keys, and Armet AI for orchestration. Fortanix offers its hardware security modules as SaaS or as an appliance.
The workloads run on confidential-computing hardware on premises, in the Azure or Google clouds, or in AI factories. In the TELUS Sovereign AI Factory, TELUS provides the infrastructure and Fortanix provides attestation and key release.
Fortanix builds the line’s trust case on hardware and cryptography. It keeps keys in a FIPS 140-2 Level 3 certified hardware security module with strict key custody and immutable audit logs. Data Security Manager releases access to data and models only to environments that pass attestation.
NIST lists certificate #4139 for the Fortanix SDKMS Appliance as an active FIPS 140-2 Level 3 validation with a sunset date of September 21, 2026. The National Vulnerability Database records CVE-2023-38021 in the Confidential Computing Manager platform for Intel SGX before version 3.32. Missing pointer-alignment validation let a local attacker access unauthorized information.
At company level, Fortanix’s trust center page includes SOC, ISO, PCI DSS, FIPS, and CIS under its industry certifications.
Fortanix Confidential AI runs within a hardware and cloud ecosystem led by NVIDIA and Intel. It runs on NVIDIA Hopper and Blackwell GPUs and Intel SGX and TDX processors, uses NVIDIA’s NRAS attestation service, and supports the Azure and Google clouds.
A partner quote on Fortanix’s page describes Fortanix as an early adopter of Azure Confidential Computing since 2020. Executives from NVIDIA, TELUS, and Deepgram are quoted in announcements of joint work on the line.
Partners give Fortanix routes to buyers. NVIDIA already supplies the NRAS attestation service, so NVIDIA, Intel, or a cloud provider could also package attestation and key release with its own offerings.
Fortanix was co-founded in 2016 by Ambuj Kumar and Anand Kashyap, and Kashyap now leads it as CEO after scaling it as CTO. TechCrunch reported his earlier role as a principal security researcher at Symantec.
Fortanix credits CTO and CISO Jethro Beekman with the design and security of its architecture since the founding. Goldman Sachs, Intel Capital, Foundation Capital, Neotribe Ventures, GiantLeap Capital, and In-Q-Tel invested in the 2022 Series C.
| Id | Source | Tier | Accessed |
|---|---|---|---|
| f1 | Fortanix: Confidential AI product page | official | 2026-09-15 |
| f2 | TechCrunch: Cybersecurity firm Fortanix secures capital to provide confidential computing services | press | 2026-09-15 |
| f3 | Fortanix platform page footer (US headquarters address) | official | 2026-09-15 |
| f4 | Fortanix press release: Raises $90M Series C, total over $122 million | official | 2026-09-15 |
| f5 | AI Defense Matrix Catalog mapping (aligned to catalog) | other | 2026-07-06 |
This site is an experimental research aid created by Zeltser Security Corp. All its data gathering and analysis was performed autonomously without human review, and it can contain errors of fact, interpretation, and judgment that a human reviewer might catch.
The analyses are statements of opinion, not statements of fact. Machine analysis produced the scores, summaries, and matrix placements by weighing the public sources each page cites, and reasonable people can weigh the same sources differently. Where a page states a fact, it cites the public source and the date it was checked, and the statement is only as accurate as that source. Unless a profile expressly says otherwise, the analysis involves no hands-on testing and no independent validation of any company's products or services.
Nothing here is professional, security, legal, financial, investment, or purchasing advice, and nothing here is a recommendation to invest in, do business with, or avoid any company. Inclusion of a company is not an endorsement, and absence of a company is not a judgment about it. Reading this site creates no advisory or client relationship. Verify any detail you plan to act on against the vendor's current materials.
The content is provided "as is" and "as available," with all warranties disclaimed, express or implied, including merchantability, fitness for a particular purpose, accuracy, and non-infringement. No entry is warranted to be complete, current, or correct. Companies change, vendors update their claims, sources can be wrong, and automated analysis can misread them.
To the fullest extent permitted by law, the operator, Zeltser Security Corp, is not liable for any damages that arise from using this site or relying on its content, including direct, indirect, incidental, special, and consequential damages and lost profits, even if advised that such damages were possible. If you are dissatisfied with the site or disagree with these terms, your remedy is to stop using it.
Entries link to vendor pages, press coverage, and other external sites that Zeltser Security Corp does not control and is not responsible for. A link is not an affiliation with the destination or an endorsement of it. Product and company names and trademarks are the property of their owners, used here nominatively to identify the companies described. Short quotations from cited sources appear for identification and commentary.
Use, quotation, automated retrieval, and redistribution of the content are governed by the Terms of Use at cybercompanyprofiles.com/terms, which permit personal and internal business use with attribution and prohibit republication and resale.