Every vendor has its own word for an isolated environment that can be attested. Some protect part of a program, some a whole virtual machine.
| Vendor and technology | The unit is called | What it protects |
|---|---|---|
| Intel SGX | Enclave | Part of a program |
| Intel TDX | Trust domain | A whole virtual machine |
| AMD SEV-SNP | Confidential virtual machine, or guest | A whole virtual machine |
| Arm CCA | Realm | A whole virtual machine |
| Arm TrustZone | Secure world, trusted application | A second, small operating system beside the main one |
| AWS Nitro Enclaves | Enclave | A stripped-down virtual machine with no network or disk |
| Apple | Secure Enclave | A separate processor for keys and biometrics |
| IBM Z and LinuxONE | Secure Execution virtual machine | A whole virtual machine |
| Microsoft Windows | VBS enclave | Part of a program, protected by the hypervisor |
| Android | Protected virtual machine | A virtual machine isolated from Android itself |
| RISC-V Keystone | Enclave | Part of a program |
The word 'enclave' alone tells you little. Ask what is inside the boundary. A small enclave keeps the operating system out of the trusted computing base. A confidential virtual machine keeps the operating system in.
'Isolate' and 'isolated environment' are generic words for the same idea. They are also used for unrelated things, so check what the vendor means.
Attested AIAttested cloud workloads
Working on re-attestation for your product? A first call takes 30 minutes and commits you to nothing. Bring your product and the one question that worries you.
Next fixed date: EU Digital Identity Wallets are due in every member state on 24 December 2026, 42 days from now.