Contrary to popular belief, enclaves do not have encrypted state The isolation and confidentiality is enforced by the AWS Nitro hypervisor Any code on the hypervisor can bypass confidentiality