The AI Advantage Comes with a Growing Security Tradeoff
For decades, enterprises have protected sensitive information with a familiar security model: encrypt data at rest, encrypt it in motion, and control who can access the systems that process it. That model was never perfect, but it had an accidental advantage—your most valuable information was enormous, fragmented, and distributed.
Customer records lived in one system. Financial information in another. Source code somewhere else. Research, contracts, operational data, intellectual property, and institutional knowledge were spread across different applications, databases, business units, and geographies. An attacker who wanted the intelligence of the enterprise had to find it, access it, steal enormous quantities of it, and then figure out how to put the pieces together. That distributed nature of knowledge, ironically, provided some protection through sheer complexity and scale.
But AI is changing that equation fundamentally.
How AI Concentrates Enterprise Knowledge
Artificial intelligence does something enterprises have spent decades trying to do themselves: it brings knowledge together. Training and fine-tuning can concentrate proprietary knowledge into model weights, while RAG (Retrieval-Augmented Generation) connects the same AI environment to information that remains distributed across enterprise repositories. In both cases, knowledge that once required access to many separate systems can increasingly be reached through a single AI interface. The AI environment becomes a concentrated representation and access point for what the organization knows—product strategy, customer behavior, research, pricing logic, software, clinical information, financial patterns, and institutional knowledge all accessible through one system.
Yesterday, stealing the accumulated knowledge of a large enterprise could require compromising multiple systems and exfiltrating hundreds of terabytes, potentially petabytes, of fragmented data. AI changes the economics dramatically. When enterprises fine-tune proprietary knowledge, they typically focus on small language models and mid-sized LLMs rather than multi-trillion-parameter mixture-of-experts systems. This is because smaller models have less inertia—a finite enterprise corpus can have a more meaningful effect on a smaller model while requiring far less compute to fine-tune and operate.
Consider the numbers: even a 120-billion-parameter model at 16-bit precision is roughly 240 GB of weights, and many enterprise models are far smaller. This means an attacker may be able to target a single artifact measured in tens or hundreds of gigabytes instead of attempting to steal and reconstruct hundreds of terabytes or petabytes of fragmented source information. The attacker no longer necessarily needs to steal your database. They may only need to steal what your AI learned from it.
The Disappearing Accidental Protection
The accidental protection that scale once provided is disappearing just as organizations are struggling with basic security hygiene. According to the 2026 IBM Cost of a Data Breach Report, 53% of breached organizations had no encryption protecting sensitive data at rest and in transit, while another 10% did not know whether encryption was being used. These numbers do not even measure encryption during computation—they reveal that organizations are still struggling to implement encryption at rest and in motion, controls that have existed for decades. Widespread adoption of the substantially more advanced controls required to protect data during computation is unlikely.
AI makes that gap considerably more dangerous. In traditional computing environments, an attacker frequently had to deal with the sheer size and fragmentation of the information being stolen. AI reduces that friction by concentrating value and making knowledge portable. It gives organizations extraordinary new capabilities, but it can also create an extraordinarily valuable target that is vastly easier to attack than ever before.
The Problem of Continuous Exposure
There is another critical difference between how AI systems operate and how traditional computing works. Traditional computing was generally built around bounded periods of processing. Data sat encrypted on storage. It moved across networks protected by encryption. When an application needed the information, it was decrypted, processed, and eventually returned to storage. The plaintext exposure window existed, but it was often relatively limited.
AI turns that window into an operating condition. Models remain loaded. Inference systems operate continuously. Prompts and context are processed throughout the day. RAG systems continuously bring enterprise documents into the AI pipeline. Training and fine-tuning can run for hours, days, or weeks. Weights, activations, embeddings, context, and other intermediate values remain part of an active computational environment. The old security assumption was built around episodic exposure—brief moments when data needed to be decrypted. AI increasingly creates continuous exposure. Applying an episodic security model to a continuously operating AI system is an architectural mismatch that leaves organizations vulnerable.
Beyond the Perimeter
The industry has made significant progress in addressing these challenges. Trusted Execution Environments and confidential computing can isolate sensitive workloads from infrastructure outside the trusted boundary. These are important technologies with an important role to play in securing AI. But isolation and encryption solve different problems.
A Trusted Execution Environment protects plaintext by creating a stronger place in which plaintext can safely exist. It answers the question: Why should the majority of the AI environment need access to plaintext at all? That distinction becomes critical as AI systems scale.
The conventional approach—protecting the perimeter around plaintext—still depends on trusting an execution environment with plaintext. The objective should be to minimize the amount of infrastructure that ever needs to see sensitive information in the first place. A more sophisticated perimeter around plaintext reduces risk, but security still ultimately depends on defending that perimeter. This is where the architecture itself has to change.
The Model as a High Value Target
This is why AI security cannot be treated as another extension of traditional application security. The model is becoming something fundamentally different from traditional software. It is software, but it can contain the value of data. It is infrastructure, but it can encode intellectual property. It is an application, but it can represent knowledge collected across an entire organization. That concentration makes AI extraordinarily useful. It also makes the model itself a target.
IBM found that 92% of organizations experiencing AI-related security incidents lacked proper access controls for their AI systems. The industry is adopting AI faster than it is adapting its security architecture to what AI has become. Adding more controls around the same plaintext execution model can reduce risk, but it does not change the underlying exposure.
The Path Forward
For years, organizations implicitly accepted a trade-off. To use data, decrypt it. To train a model, expose the information to the infrastructure performing the computation. To achieve GPU performance, allow the GPU environment to operate on plaintext. To use AI in the cloud, trust the cloud environment with the assets being processed.
That trade-off does not have to be accepted. The better security objective is simple: encrypt the information before it enters the untrusted environment, keep the valuable AI assets encrypted during computation, and minimize the trusted boundary required to make the system work. AI should not force organizations to choose between protecting proprietary knowledge and extracting value from it.
Most organizations have not yet considered what this means. They are still building AI security as though the underlying architecture matches traditional computing—as though the perimeter is the problem and more sophisticated access controls are the answer. But the concentration of knowledge into models changes the equation.
Yesterday, the sheer size and fragmentation of enterprise data gave defenders an accidental advantage. AI is removing that advantage by concentrating knowledge into smaller, more valuable, and more portable assets—models that can hold enormous strategic value in only tens or hundreds of gigabytes. Security architecture has to evolve accordingly.
The architectural approaches to address this already exist. Most organizations simply haven’t considered them yet.
Because in the AI era, protecting the database is no longer enough. You also have to protect what the model learned from it.