Intel to phase out SGX after Xeon Diamond Rapids in favor of TDX

From SGX to TDX

Intel said it will stop supporting Software Guard Extensions (SGX), which creates hardware-protected enclaves inside applications, after its upcoming Xeon 'Diamond Rapids' processors. The company will concentrate its confidential computing investment on Trust Domain Extensions (TDX).

The two technologies work differently: SGX isolates only selected code and data from the operating system and hypervisor, while TDX protects entire virtual machines from the underlying host environment. That makes TDX attractive to cloud providers running large numbers of VMs, since it can protect existing workloads without extensive application changes.

Transition timeline

Diamond Rapids will be the final Xeon generation to support SGX. Intel will keep providing security updates and support for SGX-enabled platforms into the early 2030s, giving customers several years to validate and migrate to TDX-based solutions.

New security capabilities

Intel plans to expand TDX with additional features:

• TDX Connect: trusted I/O designed to protect data moving between a VM and accelerators or peripherals.
• Post-quantum cryptography: encryption meant to withstand future threats.
• Enhanced attestation: better verification of protected environments.

Intel has not disclosed specific availability dates for these enhancements.

Agentic AI as a driver

One key driver behind the strategy is the rise of autonomous AI agents. Because these agents may access sensitive enterprise data and act across multiple systems, they need protection. Intel expects many such workloads to run on CPUs and argues TDX can protect entire agent execution environments without extensive software modifications.