The paradox exists because today’s AI still forces enterprises to reveal what they are trying to protect.
By Ravi Srivatsav, CEO & Co-founder, DataKrypto
AI takes years of intellectual property, scattered across systems and people, and brings it together inside the execution environment. That is the real risk in enterprise AI right now, and almost nobody is talking about it in those terms.
Satya Nadella recently came close. He described what he called the “Reverse Information Paradox“: enterprises, he argued, are now paying for intelligence twice, once through investment in models, infrastructure and compute, and again through the proprietary knowledge they hand over every time employees connect internal systems, submit prompts or expose operational data to AI-driven workflows.
Nadella has identified an important symptom. The cause sits one architectural layer deeper.
Underneath that economic paradox sits an architectural one: the assumption that enterprise intelligence must become visible somewhere in the runtime before it can be used at all. That assumption is what makes the economic version possible in the first place.
Knowledge is abundant inside most enterprises. What is scarce is a way to compute on that knowledge without exposing it in the process. That gap is the real constraint on the AI economy.
Here is what makes that gap dangerous. Engineering expertise, operational history, commercial context, proprietary models and institutional experience have always lived in separate systems, guarded by separate controls. AI is the first technology to pull all of it into a single execution window at once. That concentration is arguably the richest expression of an organization’s IP — and the more successful AI becomes at synthesizing it, the more valuable, and the more exposed, that concentration becomes.
Take a semiconductor manufacturer investigating an unexpected yield decline. An AI system might draw simultaneously on proprietary process models, equipment telemetry, supplier data, maintenance histories, manufacturing recipes and quality metrics, while other agents independently analyze materials science, logistics and operational performance. Together, they are the edge: years of investment and engineering judgment assembled in a single computational event more valuable than any database the company owns.
Where Value Used to Live
For most of the digital era, organizations knew exactly where their competitive advantage resided. Customer data lived in CRM systems. Financial records sat in ERP platforms. Source code stayed in repositories; contracts and IP lived in document systems. Security strategy followed naturally: protect the location, and in most cases the information stayed protected.
AI breaks that model, because it rarely reasons from a single source. A single inference might combine proprietary models, internal documents, retrieval systems, operational data, business policy, customer history, external services and the output of other AI agents. No one component represents the organization’s distinctive value on its own. The value appears only when they’re assembled into a single act of reasoning — and that assembly is where the exposure concentrates.
This is where today’s AI security conversation starts to feel incomplete. Governance, identity, access management, compliance and responsible AI are all necessary disciplines, but none of them questions the premise underneath: that sensitive information will inevitably become visible during computation, and that the job is to manage the risk around that visibility rather than eliminate it.
Agentic AI raises the stakes further. An autonomous agent retrieves from enterprise systems, holds context over time, invokes tools, coordinates with other agents and executes business processes on its own. Every added capability widens the aperture of what gets concentrated, and exposed.
Those capabilities are being built right now on infrastructure designed around the same assumption.
Why This Hasn’t Been Fixed
Every major AI platform today, across the industry’s largest cloud and model providers, is grappling with how to make enterprise AI more secure — and the industry’s answer so far has mostly been isolation: harden the hardware, lock down the perimeter, attest the environment. What’s still missing is a way to compute on the data itself without exposing it. That gap is the real bottleneck, and it is the reason the paradox Nadella describes exists at all.
For two decades, enterprise security practice taught organizations never to expose their crown jewels: encrypt data at rest, encrypt data in transit, segment access, minimize blast radius. Then generative AI arrived, and the industry’s position inverted. Suddenly the only way AI could work, enterprises were told, was by exposing those same crown jewels during every inference.
The industry did not choose plaintext computation out of laziness. For years, it was the only broadly practical option for large-scale AI given the available performance, hardware and cryptographic techniques. But “only workable option” and “permanent law of physics” are very different claims, and the industry has often treated them as if they were the same.
What Models Keep
There is another risk here that matters just as much. Once enterprise knowledge has been used to train, tune, or adapt a model, the problem does not end when the interaction ends.
These mechanisms should not be confused. A normal inference request does not ordinarily rewrite the model’s weights. Retention may instead occur through provider logging, cached context, retrieval stores, application memory or explicit memory features. Training and fine-tuning create a different risk because proprietary information may become statistically encoded into the model itself.
That changes the nature of the risk. The first issue is the moment when intelligence becomes visible during computation. The second is the possibility that the system has absorbed enough of that intelligence to carry it forward in its behavior, outputs, memory, or future responses. In that case, the enterprise is no longer only controlling access to data. It is dealing with a system that may have retained something it was never meant to keep.
If the material includes proprietary logic, operational history, commercial strategy, or customer information, the system has already crossed a boundary. The output may not repeat the source exactly, but the knowledge is no longer entirely outside the model.
Memory features make that risk easier to see, but they do not create it. A system can retain through model weights, attached memory layers, retrieval stores, cached context, or the way applications reuse prior interactions. Once that happens, the enterprise is facing more than inference risk. It is facing retention risk.
That distinction matters. Exposure is dangerous because it reveals intelligence at the point of greatest concentration. Retention is dangerous because it gives that exposure a longer life, a wider surface area, and a harder path to removal.
Isolation Is Not the Same as Protection
Confidential computing has emerged as a serious response, built on hardware isolation, remote attestation and trusted execution environments. These are real advances, and they earn their place in the stack. Remote attestation ultimately depends on keys, certificates, firmware and reference measurements controlled by the processor manufacturer. In vendor-provisioned architectures, a compromised or legally compelled manufacturer could potentially certify an alternative attestation identity that still appears valid to the customer. This does not necessarily break memory isolation, but it means attestation cannot provide cryptographic independence from the vendor controlling the trust hierarchy.
Attestation ecosystems also face the transition to post-quantum cryptography. Wrapping a processor quote based on RSA or elliptic-curve cryptography inside a post-quantum certificate does not make the underlying evidence quantum-resistant. If the installed processor cannot generate quantum-resistant attestation evidence from a protected hardware root, complete migration ultimately requires new hardware or a new hardware-protected attestation component.
When a vulnerability turns up in a trusted execution environment, or the attestation scheme underneath it needs to be upgraded, the fix is a new generation of chips, not a software update. That’s a capex decision measured in refresh cycles, not a Tuesday deploy.
An entire sector is scaling around the assumption that isolating the hardware is as far as protection can go. That assumption is shaping serious investment today, and it still leaves the core exposure in place — and the bill for fixing it later is a hardware bill, not a software one.
More fundamentally, protecting the environment in which computation happens is not the same as protecting the intelligence moving through it. A trusted execution environment can keep the cloud host, the hypervisor, and the infrastructure operator from seeing inside — that’s real, and it closes a genuine gap. Confidential computing also introduces a hardware-dependent, vendor-controlled security lifecycle. While some vulnerabilities can be mitigated through firmware, microcode or software updates, others reveal limitations in the silicon-enforced isolation boundary that cannot be fully resolved without a new hardware generation. But inside that boundary, models, prompts, embeddings and intermediate computations still exist in plaintext, which means the organization’s most valuable knowledge is only as protected as the hardware, firmware and operating system running underneath it. Isolation shrinks who can see the data. It doesn’t shrink how much of it still has to exist in the clear for someone, or something, to trust.
We have been here before, sort of. HTTPS solved the easy version of this problem: it kept data unreadable while it moved from one place to another. Nobody had to do math on the ciphertext along the way — it just had to arrive intact. AI needs the harder version. It has to compute on the data, not just carry it. That’s the problem we solved.
The Real Choice
Nadella is right that AI is reshaping the economics of knowledge. The deeper shift, though, is physical rather than economic: intelligence itself now exists dynamically, briefly, and at a level of concentration nothing before it produced. The industry moved too fast to stop and ask whether this intelligence needs to be visible in order to be useful, and for years the honest answer would have been that computing on encrypted data at any usable speed was not yet practical. That is no longer true.
Encrypted execution was hard to adopt when enterprise data was scattered across a thousand disconnected systems, each with its own format and access pattern. AI has already done the work of pulling that data into a small number of concentrated computation points. The same concentration that made this intelligence dangerous to expose is what now makes it practical to protect.
History suggests architectures change.
Removing plaintext from AI computation entirely, rather than managing the risk around it, is the shift enterprise security should be paying attention to right now.