AMD SEV-SNP: Trust Nobody, Encrypt Everything

Fri, 05 Jun 2026 00:00:00 +0000

Your cloud provider can read your VM’s memory. Full stop. I don’t care what their marketing page says. If you’re running on standard hardware with standard virtualization, the hypervisor has god-mode access to every byte of your guest’s RAM. Your encryption-at-rest doesn’t matter. Your TLS doesn’t matter. The moment your data is in memory, it’s naked and the hypervisor is watching.

This is the problem AMD set out to solve with SEV-SNP, and after deploying this stuff in production across multiple clusters, I’m going to walk you through exactly how it works — all five generations of it — because understanding the evolution explains why the final product looks the way it does.

Sev-Snp on Hunter Wigelsworth

AMD SEV-SNP: Trust Nobody, Encrypt Everything