A new generation of encryption is coming, built to withstand future quantum computers that could one day crack today’s codes.
The catch: stronger locks can mean more work for the equipment that handles every connection, including the chatbots and other artificial intelligence services businesses now run.
VIAVI, a maker of network testing gear, released a pizza-box-sized machine that floods networks with realistic, quantum-safe encrypted traffic, so companies can find out whether the new locks slow things down before customers notice.
VIAVI Solutions (NASDAQ: VIAV) introduced the CyberFlood CF50 on September 29, 2026, a one-rack-unit (1U) test appliance that generates realistic encrypted application traffic at up to 100 gigabits per second (100G) to test application performance, security controls, AI inference and large language model (LLM) services. VIAVI said the CF50 includes native support for post-quantum cryptography (PQC), delivers TLS performance 1.75 times that of its nearest competitor, and has the industry’s lowest power consumption in its class.
The CF50 is aimed at network equipment manufacturers, systems integrators and service providers, and sits below the existing CyberFlood CF1000, which VIAVI targets at large enterprises that need the highest performance.
Executive Summary
The CF50 is a traffic generator: it impersonates large numbers of users and applications so that engineers can see how firewalls, gateways, load balancers and AI services behave under load before real customers arrive. What distinguishes it, by VIAVI’s account, is that it combines three things in a small box: Layer 4-7 traffic (traffic that looks like real applications rather than raw data packets), security assessment, and AI inference testing, with post-quantum encryption built in.
That combination matters because two infrastructure transitions are happening at once. Organizations are putting AI inference, the step where a trained model answers requests, into production over encrypted connections, and they are preparing to move those connections to quantum-resistant encryption. Both place new demands on the same security equipment. A tester that can generate both kinds of traffic turns the question of whether post-quantum encryption slows AI services into something a lab can measure rather than something operations teams discover after launch.
The headline performance claims, 1.75X TLS performance and lowest power consumption, are VIAVI’s own, and the company has not published the competitor, metric or test conditions behind them. The practical value of the launch rests less on those superlatives than on whether PQC and AI inference traffic can be exercised together at realistic scale.
Post-Quantum Encryption Is a Performance Question, Not Just a Security One
Post-quantum cryptography replaces the mathematical methods that protect today’s encrypted connections with algorithms designed to resist future quantum computers. The US standards body NIST published its first post-quantum standards in 2024, and the pressure to adopt them comes partly from the risk that adversaries are recording encrypted traffic now in order to decrypt it later. The trade-off is that post-quantum key exchanges use considerably larger keys than the methods they replace, which means more data and more computation each time an encrypted TLS session is set up. TLS is the protocol behind the padlock in a browser and behind most API traffic.
That cost does not fall evenly. It lands on the devices that terminate or inspect encryption at scale: next-generation firewalls, secure web gateways, load balancers and the Zero Trust architectures (security designs that verify every connection rather than trusting anything inside the network perimeter) that VIAVI’s announcement names. AI inference traffic runs through exactly this equipment. A user query to an LLM-powered service is typically an encrypted request that passes security controls before it reaches the model and after the answer comes back, and inference services are judged heavily on responsiveness. Any added handshake overhead or reduced connection capacity shows up directly as latency or as a need for more security hardware.
This is where the CF50 changes the workflow. VIAVI says the appliance generates encrypted and mixed application traffic up to 100G with native PQC support, and separately offers AI inference and LLM testing. For the network equipment makers, integrators and service providers VIAVI is targeting, that means the performance impact of switching a firewall or gateway to post-quantum TLS can be measured against realistic application and AI traffic in the lab, before deployment. The overhead becomes a number that goes into sizing and procurement decisions rather than a surprise in production. How fully that promise holds depends on whether both traffic types can run in the same test, which VIAVI’s announcement implies but does not spell out.
What the 1.75X and Lowest-Power Claims Do and Do Not Establish
VIAVI states that the CF50’s TLS performance is 1.75 times that of the nearest competitor and that it has the industry’s lowest power consumption. Both claims are plausible marketing for a product in a competitive test-and-measurement category, and both are unverified. The company has not named the competitor or product compared, specified whether the metric is new connections per second, concurrent sessions or encrypted throughput, stated whether the comparison used classical or post-quantum cipher suites, or published a wattage figure.
Those distinctions matter to buyers. A tester that leads on encrypted throughput may not lead on handshake rate, and handshake rate is where post-quantum overhead concentrates. A power figure matters for labs with constrained rack power, but lowest-in-class means little without knowing the class. The quote from Mauricio Sanchez of Dell’Oro Group supports the general case for realistic pre-deployment testing of AI and encrypted workloads. It does not address the CF50’s specific performance figures, and readers should not treat it as independent validation of them.
A Smaller Box Widens Who Can Afford This Kind of Testing
High-scale encrypted traffic testing has traditionally required large chassis systems and specialist operators. The CF50 packs the capability into 1U, a single standard rack slot about 1.75 inches tall, and replaces a Windows desktop client with a web interface. VIAVI also includes automated goal-seeking, which ramps load until a device under test reaches its limit, MITRE ATT&CK frameworks, a public catalog of real-world attacker techniques used to check whether security controls detect them, and repeatable traffic-mix testing.
The commercial logic is to extend enterprise-scale testing below the tier served by the CF1000 to smaller equipment vendors and integrators. If the portability and price hold up, more of the security and networking supply chain can test post-quantum and AI-traffic performance in-house rather than relying on vendor datasheets. VIAVI has not disclosed pricing, so the cost-effectiveness claim, like the performance claims, awaits specifics.
Background
VIAVI Solutions, based in Chandler, Arizona, is a test-and-measurement and optical technology company. Its test products are used to validate data center, communications network and security infrastructure, and it also supplies resilient positioning, navigation and timing systems for military, aerospace, railway and first-responder communications, alongside optical technologies for anti-counterfeiting, consumer electronics and automotive markets.
CyberFlood is VIAVI’s line of application and security test platforms, which emulate large numbers of users and applications to measure how networks and security devices perform. Before the CF50, the line’s flagship was the CF1000 for large enterprises. The new model arrives as organizations move AI inference into production and begin preparing encrypted connections for the transition to post-quantum cryptography.
Artificial intelligence programs are starting to touch the systems that actually run a country: power grids, water utilities, defence networks, government records. Those systems are deliberately kept off the internet so nothing outside can reach them.
Wand AI and Zeroport say they have a way to let automated software workers operate them anyway. The software gets no connection at all. It sends keystrokes down a wire built so that data physically cannot travel back, and receives only a moving picture of the screen, like looking through a window.
A separate computer watches every frame and can cut the session off mid-task.
Wand AI said in a September 9 announcement distributed over PR Newswire that it has added Zeroport to its Sovereign AI offering, incorporating Zeroport’s Fantom hardware boundary and its Moativ enforcement layer into Wand’s agent platform. The stated goal is to let government programs point autonomous AI agents at segmented and air-gapped estates, including grid, water, SCADA, defence, banking and registry systems, without creating a network route into them.
Under the joint reference architecture, Wand’s runtime dispatches an agent session to a dedicated Fantom Core rather than to an endpoint inside the protected network. Only keystroke and mouse input travels inward across a one-way hardware break, and only a display-only pixel stream travels outward. Moativ, an on-device model running on NVIDIA Jetson Thor accelerators inside the same appliance, inspects every input and every frame and can alert, block or physically sever the session. The companies say the architecture is available to sovereign programs and enterprises now, and that adopting Zeroport is elective rather than required.
Executive Summary
The announcement addresses a real and specific bottleneck. National AI programs are moving past document summarisation toward operating systems of record and systems of control, and those are precisely the estates that security teams spent a decade making unreachable. Connecting an agent to them the conventional way means provisioning an interface, a credential and a network path, which recreates the exposure the segmentation was designed to eliminate. Zeroport’s argument is that the route itself should be removed rather than narrowed.
The technical claim has two halves, and they deserve separate treatment. The first is that the access path is physical: a partition built from the chip up that carries no IP packet and terminates no network session, so an agent reaches the protected system the way a cleared human operator does, keystrokes in and pixels out. The second is that the policy governing the agent lives out of band, on hardware the governed session has no address for, which answers a genuine weakness in software guardrails that run on the same computational plane as the model they police.
What the companies have described is an architecture and a reference design, not a deployment record. No sovereign customer, contract value, pilot result or third-party certification accompanies the announcement, and the performance figures are stated as targets and capacities rather than measured production results. The architectural idea is coherent and the problem is well framed; the evidence that it works at national scale is still forthcoming.
The Last Mile of Sovereign AI Is an Access Problem, Not a Model Problem
Sovereign AI has largely been discussed as a question of ownership: whose chips, whose weights, whose data centre, whose law. That framing gets a country to a capable model sitting on domestic compute. It does not get the model anywhere near the substation control interface, the water treatment historian, or the case management system where the work actually is. Air-gapping means a network is physically or logically isolated with no routable connection to the outside, and organisations do it precisely because a path into those estates is a national risk before it is an IT risk.
Wand’s positioning treats that last mile as the binding constraint on the value of AI labour, and the logic holds. An agent restricted to systems already reachable through ordinary enterprise controls is confined to the least consequential half of a ministry’s estate. The alternatives on offer today all involve a trade the release characterises fairly: virtual private networks, zero-trust network access and privileged access management gateways narrow and log the route but preserve it, so it remains enumerable and exploitable; guardrail software asserts policy on the same plane as the model, where a sufficiently capable model can be argued out of it; and leaving the estate offline removes the route by removing the workload.
Zeroport cites roughly two-thirds of cyber-attacks as exploiting remote access tooling and 80 percent of breaches as involving stolen or compromised credentials. Neither figure is sourced in the announcement, and both are the kind of round number that circulates widely in vendor material, so they should be read as framing rather than evidence. The underlying point survives the caveat regardless: remote access is the dominant vector in most credible threat models, and an agentic layer multiplies the number of sessions requesting it.
Physics Governs the Route; Software Still Governs the Judgment
The strongest part of this architecture is also the most conventional. A one-way hardware break that admits only human-interface signals and emits only pixels is a descendant of the unidirectional gateway and data diode designs that have protected operational technology perimeters for years, combined with the display-only principle behind remote desktop and browser isolation. Applying that lineage to agent sessions is a sensible extension rather than an invention, and it inherits the property that matters: there is no packet to smuggle a payload inside, and nothing for a compromised or drifting agent to pivot into. Revoking an agent removes the path outright rather than closing a session on a path that persists.
The second claim needs more care. Moativ enforces policy from silicon the governed session cannot address, which genuinely defeats the prompt-injection and goal-drift failure modes where an agent talks its way past a rule that lives in its own context. But Moativ is itself a model making content-level judgments about what is on screen and what was typed. Physics secures the channel; a classifier decides intent. That classifier can produce false negatives, in which a harmful action reads as sanctioned, and false positives, in which legitimate work is severed. On a control system, a wrongly terminated session mid-action is not a neutral outcome.
The controls around that risk are described more concretely than most vendors manage. Rules are written in plain language and compiled into staged detectors, dry-run against a program’s own session history before they are armed, with autonomy set per group on a five-step dial running from observe through alert, investigate and terminate to self-tune. Dry-running policy against real historical sessions is the right way to calibrate an enforcement model, and the audit trail attaches screen content, keystrokes and rationale to every autonomous action. What is absent is any published figure for detection accuracy or intervention rate.
Pixels In, Pixels Out: What the Agent Gives Up
Routing an agent through a screen rather than an application programming interface is a security gain purchased with capability. Agents that drive graphical interfaces are measurably less reliable than agents calling structured interfaces, because they must locate controls visually, tolerate rendering variation, and recover from states no schema describes. Every task must be expressible as keystrokes and mouse movement against a live display, and nothing structured comes back, only pixels. For supervisory control work performed by a human operator today, that is a natural fit. For bulk data extraction, batch reconciliation or anything requiring high-volume structured output, it is a poor one, and it is worth noting that the pixel-only return path is exactly what makes exfiltration hard.
The economics scale in a way network overlays do not. Capacity grows in Cores and then in appliances, with hundreds of concurrent sessions per appliance and thousands per rack, and humans and agents riding the same rails with no shared tunnel to bottleneck. That converts a licensing question into a hardware procurement question, which is familiar territory for defence and utility buyers and appears in a capital budget rather than an operating one. The dedicated pathways target sub-50-millisecond latency, stated as a design target, which is the threshold that separates a channel usable for live control from one fit only for after-the-fact review. All inspection happens on-premises and no session content leaves the rack, a claim that matters more to sovereign buyers than almost anything else in the architecture.
An Ecosystem Assembled Layer by Layer
This is the third such addition Wand has announced in the same pattern, following a storage efficiency layer and a model robustness layer, and alongside existing inference privacy and confidential computing capabilities. The construction is deliberate: a sovereign platform assembled from independently adoptable components, none a prerequisite for another, each addressing a distinct objection a national buyer might raise. It is a credible route to breadth for a company founded in 2023, and it lets Wand answer a procurement checklist without building every layer itself.
It also leaves the commercial substance of each addition undefined. The announcement describes a joint reference architecture and mutual technical fit, but not whether Zeroport hardware is resold by Wand, jointly supported, revenue-shared, or merely certified as compatible. Buyers evaluating an integration care about which entity holds the support contract when an appliance severs a session on a live grid system. It is also worth recording plainly that Fusion Fund appears as an investor in both companies, which is unremarkable in a specialised market but relevant context for how ecosystem partnerships form.
For Zeroport, founded in 2024 in Herzliya by security and military-intelligence veterans, the partnership offers distribution into national programs that a two-year-old hardware company would otherwise reach slowly. For Wand, whose offices include Abu Dhabi and whose stated customer base spans banks, asset managers and system integrators, it supplies an answer to the question sovereign buyers ask last and hardest: what happens when the agent has to touch the thing that matters.
Background
Sovereign AI describes a country’s effort to run artificial intelligence on domestic compute, under domestic law, with control over the models, data and policies involved. The first wave of national programs concentrated on procuring accelerators and building data centres. The second, now underway, tries to convert that capacity into operational work inside ministries, utilities and defence estates, which raises a problem the first wave never had to solve: the highest-value systems are the ones deliberately made unreachable.
Wand AI, founded in 2023 and headquartered in Palo Alto with offices in New York and Abu Dhabi, sells an operating system for deploying and governing AI agents alongside humans, with identity, authority, audit and governance built in. It is backed by Shasta Ventures, Fusion Fund, Thiel Capital and Palo Alto Growth Capital, and has been assembling its sovereign offering as a series of independently adoptable layers covering inference privacy, confidential computing, model robustness and storage efficiency. Zeroport, founded in 2024 in Herzliya, Israel, holds multiple patents on its Fantom platform and says it is deployed across critical infrastructure, energy, defence, financial services and government environments, with backing from lool ventures, Clarim Ventures, CyberFuture and Fusion Fund.
Kasm Technologies and Everfox announced a strategic technology partnership on August 20, 2026, combining Kasm Workspaces — a container-based platform that streams desktops and applications to users in disposable, policy-controlled sessions — with Everfox’s Trusted Thin Client, a purpose-built zero-trust endpoint for accessing networks at different security classification levels. The joint solution, available now, targets government, defense, and intelligence agencies that today issue multiple devices or run parallel virtual-desktop stacks to keep classified networks separated.
Executive Summary
The announcement pairs two specialized vendors around one problem: giving cleared personnel access to applications and desktops across multiple classification levels from a single device. In classified environments, networks at different levels (for example, unclassified versus secret) are deliberately kept apart, which historically means separate computers, separate virtual desktop infrastructure (VDI) stacks, and the cost and desk clutter that come with them. Everfox contributes the cross-domain access layer — its Trusted Thin Client bridges those separated networks on validated hardware — while Kasm contributes the workspace layer, streaming containerized desktops and applications into ephemeral sessions that are centrally managed and fully wiped when they end, so no data persists on the endpoint.
The companies emphasize that adoption does not require a rip-and-replace: Kasm Workspaces integrates with existing hypervisors, cloud environments, and identity providers, letting agencies layer modern workspace delivery onto current infrastructure and migrate at their own pace. The announcement is a technology partnership with immediate availability, but it names no customers, contract values, or accreditation milestones — it establishes a joint offering, not demonstrated adoption.
The Economics of Endpoint Sprawl
The clearest business case in this release is cost consolidation. In many classified settings, working across networks means a physical computer per classification level on each desk, or a separate VDI environment per network — each with its own licensing, patching, and support burden. The release frames the joint solution as a direct replacement for these “multi-endpoint, multi-VDI-stack approaches,” collapsing them into one validated device and one workspace platform. If the technology performs as described, the savings show up not just in hardware counts but in operational overhead: fewer stacks to patch, fewer images to maintain, and central policy enforcement instead of per-device configuration.
That said, the release quantifies none of this. There are no cost-comparison figures, seat counts, or reference deployments, so the economic argument rests on the general premise that fewer endpoints and fewer parallel stacks cost less — plausible, but unproven in this document.
Containers as a Challenger to Legacy VDI
The more interesting technical bet is architectural. Traditional VDI runs each user a full virtual machine, which is resource-heavy and rigid. Kasm’s model instead streams desktops and applications from containers — lightweight, fast-starting software packages — into browser-delivered sessions that exist only for the duration of use and are destroyed at termination. In security terms, ephemerality is a feature: a session that is fully wiped leaves no residual data on the endpoint, which matters enormously when the endpoint touches multiple classification levels.
Defense environments, however, are conservative adopters for good reason. Cross-domain solutions face some of the most demanding assurance expectations in government IT, and the release does not address how the combined stack is accredited or evaluated for cross-domain use — only that Everfox’s hardware is “validated” and its solutions are “purpose-built” for high-assurance environments. Whether container isolation plus a trusted thin client satisfies each agency’s specific approval processes is the question that will actually determine adoption, and it is not answered here.
The No-Rip-and-Replace Pitch
Both companies clearly understand their buyer. Agencies running classified missions cannot take infrastructure offline for a wholesale migration, so the release leans hard on incrementalism: Kasm integrates with existing hypervisors, clouds, and identity providers, and agencies can “transition at a pace that does not put critical missions at risk.” Kasm’s chief product officer, Daniel Ben-Chitrit, also stresses the absence of vendor lock-in and the platform’s on-premise deployment model — both sensitive points for government buyers wary of dependency on any single supplier or on commercial cloud availability.
Strategically, the partnership is complementary rather than overlapping: Everfox gets a modern desktop-delivery story to pair with its cross-domain plumbing, and Kasm gets a credentialed route into classified networks it could not plausibly enter alone. The risk cuts the other way too — a technology partnership without disclosed go-to-market commitments, joint contract vehicles, or named integrator support can remain a datasheet exercise. The release states the joint solution is available now, which is a stronger claim than a roadmap announcement, but availability and adoption are different things.
Background
Kasm Technologies builds an open-core platform for streaming containerized desktops, browsers, and applications to users through the web browser — a container-based alternative to virtual desktop infrastructure (VDI), the long-standing enterprise approach of hosting each user’s desktop as a virtual machine in a data center. Everfox operates in the cross-domain solutions market, supplying trusted access and secure data transfer between networks at different classification levels for government, defense, and intelligence customers, where high-assurance requirements have historically favored purpose-built hardware and specialized vendors.
The partnership lands amid a broader government push to modernize classified-environment IT, where the default pattern of one endpoint per network has become an acknowledged cost and usability burden. It also extends a run of alliance announcements from Kasm, which recently shipped Kubernetes support in Workspaces 1.19 and a stealth-networking integration with Dispersive, suggesting a deliberate strategy of pairing its workspace layer with specialized security partners rather than building those capabilities alone.
President Trump has signed a National Security Memorandum aimed at strengthening the cybersecurity of U.S. military and intelligence systems, according to a June 14, 2026 report from Homeland Security Today. The directive targets the government’s most sensitive networks — the classified and mission systems that fall outside the rules governing ordinary civilian federal IT.
Details of the memorandum’s specific requirements, deadlines, and funding were not included in the source report, so the scope of the mandate beyond its stated goal — hardened defenses for military and intelligence systems — remains to be confirmed from the document itself.
Executive Summary
A National Security Memorandum (NSM) is a presidential directive used to steer national security policy across the Department of Defense and the intelligence community. This one, per the Homeland Security Today report, orders a strengthening of cybersecurity for military and intelligence systems — the category the government formally calls national security systems, which operate under their own rulebook separate from civilian agency networks.
The announcement matters for two reasons. First, national security systems carry the country’s most consequential data — weapons control, intelligence collection, command and control — and are the highest-value targets for state-sponsored attackers. Second, presidential directives in this space tend to cascade outward: past directives of this kind translated into binding technical requirements for agencies and, eventually, into procurement obligations for the contractors and infrastructure providers that build and host these systems.
What is not yet clear is how prescriptive this memorandum is. The public reporting available at publication confirms the signing and the goal, but not the mechanisms — whether it sets new technical baselines, new deadlines, new reporting duties, or new authorities. That distinction will determine whether this is a significant operational shift or a reaffirmation of existing policy.
What a National Security Memorandum Can Actually Do
Presidential directives come in different weights. Executive orders on cybersecurity, such as the landmark 2021 order on improving the nation’s cybersecurity, generally bind civilian agencies. National security systems — networks handling classified information or supporting military and intelligence missions — are deliberately carved out and governed through separate instruments, with the National Security Agency serving as the designated national manager for their security. An NSM is the standard vehicle for directing change in that classified domain, which is exactly why this format was used here.
The practical effect of an NSM depends on its plumbing: whether it directs specific agencies to issue binding operational directives, sets measurable deadlines, and assigns oversight. The 2022 memorandum known as NSM-8, for example, gave national security systems concrete timelines for adopting multifactor authentication and encryption and required agencies to report cross-domain systems to the NSA. If the new memorandum follows that pattern, agencies and their contractors will see enforceable requirements; if it is primarily a statement of priorities, its effect will depend on follow-on implementation guidance.
Why Military and Intelligence Networks Are a Distinct Problem
Hardening national security systems is a different engineering challenge from securing ordinary enterprise IT. These environments include air-gapped classified enclaves, decades-old weapons platforms that cannot simply be patched, and cross-domain solutions that move data between networks of different classification levels — each a specialized attack surface. The Department of Defense has been pursuing a zero trust architecture, a security model that assumes no user or device is trusted by default, with a stated target of implementation across the department by fiscal 2027. A new presidential directive landing in mid-2026 arrives squarely in the execution window of that effort.
The threat context is well established even where this memorandum’s text is not. State-sponsored intrusion campaigns against U.S. defense networks and defense industrial base companies have been publicly documented by U.S. agencies for years, and the compromise of contractors — rather than the classified networks themselves — has repeatedly proven to be the softer entry point. Any serious hardening directive has to reckon with that supply chain reality, which is why observers will look closely at whether this NSM extends obligations to contractors and cleared cloud providers.
Follow the Procurement: Who Stands to Gain
Directives of this kind reliably move money, even when they arrive without new appropriations. Requirements for stronger identity controls, encryption modernization, network segmentation, and continuous monitoring translate into demand for the vendors that supply those capabilities — and into compliance burdens for the defense contractors that must meet them. Providers of classified-capable cloud regions, secure colocation, and accredited connectivity sit upstream of all of it: hardened systems still need hardened facilities, power, and network paths to run on.
The cautionary note is timing. Federal cybersecurity mandates historically outpace the budgets attached to them, and implementation across the intelligence community and military services can stretch years past initial deadlines. Buyers and investors should treat the memorandum as a directional signal about sustained federal demand for defense-grade security infrastructure, not as a near-term revenue event — at least until implementing directives, budget requests, and contract vehicles make the requirements concrete.
Background
U.S. federal cybersecurity policy runs on two parallel tracks. Civilian agency networks answer to the Cybersecurity and Infrastructure Security Agency and directives like the 2021 executive order on improving the nation’s cybersecurity, which mandated zero trust adoption and software supply chain standards. National security systems — the classified and mission networks of the military and intelligence community — follow a separate track: the 2022 directive NSM-8 extended equivalent-or-stronger standards to those systems and reinforced the NSA’s role as their national manager.
The June 2026 memorandum continues a two-decade pattern of successive administrations tightening requirements on this second track as state-sponsored cyber operations against defense targets have escalated. For the infrastructure industry, that pattern has steadily expanded the market for defense-grade security: accredited cloud regions, secure facilities, encrypted connectivity, and the compliance regimes — such as CMMC for defense contractors — that govern who may build and operate systems touching sensitive government data.
NVIDIA published a technical blog on May 30, 2026 making the case for “in-silicon security” for agentic AI infrastructure, delivered through DOCA — the software framework for its BlueField data processing units (DPUs). The pitch: as AI systems shift from answering prompts to autonomously taking actions, the security controls protecting AI data centers should move out of host software and into dedicated hardware at the network edge of every server.
Executive Summary
The post positions DOCA, NVIDIA’s development framework for BlueField DPUs, as the security layer for what the company calls AI factories — data centers purpose-built to produce AI inference at scale. A DPU is a programmable processor that sits on the server’s network card and handles networking, storage, and security tasks so the CPU and GPU don’t have to. Running security there, rather than in the operating system, means the enforcement point survives even if the host itself is compromised.
The timing tracks the industry’s pivot to agentic AI — systems that plan, call tools, and act on other systems with limited human supervision. That autonomy multiplies machine-to-machine traffic inside the data center and widens the blast radius of any single compromised workload, which is precisely the traffic that perimeter firewalls never see. NVIDIA’s argument is that the enforcement point has to move to where that east-west traffic actually flows: the server’s own network interface.
It matters because NVIDIA is not a neutral party here. If security becomes a silicon feature of the AI stack, the company that already supplies the GPUs, the networking, and the DPUs consolidates one more layer of the platform. The blog is a technical argument, not a product launch — and readers should weigh it as both engineering guidance and strategic positioning.
Agentic AI Breaks the Perimeter Model
Traditional data center security assumes a hard shell and a soft interior: inspect traffic at the boundary, trust most of what happens inside. Agentic AI erodes that assumption. When autonomous agents call APIs, query databases, spin up jobs, and message other agents, the overwhelming majority of traffic is east-west — server to server inside the facility — and it is generated by software identities, not humans logging in.
That shifts the useful control point from the perimeter to the individual server. Zero trust — the model in which no connection is trusted by default and every request is verified — has been the stated direction of enterprise security for years, but enforcing it on every packet between thousands of GPU servers is computationally expensive. NVIDIA’s framing of the DPU as the natural place to do that enforcement is a coherent answer to a real architectural problem, whatever one concludes about the specific product.
Why the DPU Is an Attractive Security Boundary
Putting security in the DPU buys two things. First, isolation: the DPU runs its own software stack, so firewalling, encryption, and telemetry keep operating even if an attacker gains root on the host — a meaningful property when the host is running semi-autonomous agents whose behavior is hard to fully predict. Second, offload: security processing done in dedicated silicon doesn’t consume the CPU cycles or GPU time that the facility exists to sell.
That second point is the quiet economic argument. In an AI factory, every host cycle spent on packet inspection is margin lost. In-silicon security is thus pitched not only as safer but as cheaper per unit of useful work — an argument that will resonate with operators watching utilization dashboards. The trade-off is operational: security teams gain a new hardware layer to program, patch, and monitor, and DOCA skills are far scarcer than firewall administration skills.
Platform Consolidation Cuts Both Ways
For NVIDIA, embedding security into DOCA deepens an already formidable platform position spanning GPUs, interconnects, and networking. For buyers, that is simultaneously the appeal and the risk. A vertically integrated stack where security is co-designed with the fabric can genuinely outperform bolted-on alternatives; it also concentrates dependency on a single vendor for compute, networking, and now the control plane that polices both.
Incumbent security vendors face a positioning question rather than immediate displacement: several already ship DPU-accelerated versions of their products, and the realistic outcome is DOCA as a substrate that third-party security software runs on, rather than a wholesale replacement. Infrastructure operators — including colocation and cloud providers hosting AI workloads — should read this as directional: the security perimeter of AI infrastructure is migrating into the server itself, and facility-level offerings will need to interoperate with it.
Background
NVIDIA transformed from a graphics chip maker into the dominant supplier of AI data center infrastructure, with its GPUs powering the large-scale model training and inference boom. Its 2020 acquisition of Mellanox brought high-performance networking in-house, yielding the BlueField DPU line and the DOCA framework introduced alongside it. Since then NVIDIA has steadily pitched a full-stack vision — compute, networking, software — for what it brands AI factories.
The security angle gained urgency through 2025 and 2026 as enterprises moved from chatbot-style AI to agentic deployments, where autonomous software acts on live business systems. That shift has pushed the industry’s long-running zero-trust conversation from corporate networks into the AI cluster itself, making the question of where enforcement lives — perimeter, host, or silicon — a live architectural debate.
