Trent Telford's company can encrypt a single paragraph inside a Google Doc so that one colleague reading it sees plain text and another, looking at the same document, sees only an encrypted block.
Most cybersecurity spending still goes into building a bigger wall around the network. Telford's company, Qanapi, starts from the opposite assumption — that the wall will eventually be breached — and encrypts the data itself, down to the individual word.
"It doesn't matter how high you build the wall. The bad guys go get a bigger ladder."
Telford has spent more than 20 years in data and cyber security, founded the encryption companies Covata and Cocoon Data before it, and now runs Qanapi, whose systems protect enterprise, federal and battlefield data down to the level of a single encrypted word.
I listened to the full episode so you can skip it. 55 minutes of audio, 18 minutes of reading.
Here are the 8 insights that matter.
👤 Guest: Trent Telford, Founder and CEO of Qanapi, a data-encryption company serving enterprise, federal and defense customers
🎙️ Host: Craig S. Smith, a longtime New York Times correspondent who hosts Eye On A.I.
📰 Published: 10 September 2026, on YouTube (Eye On A.I.)
🔴 YouTube | 🔗 Episode page | ⏱️ 55 min | ✅ Time saved: 43 min
Key Takeaways
The internet was never designed to be secure, so 25–30 years of cybersecurity has been retrofitting locks onto a system built to share, not protect
SSL, the padlock browsers still rely on, dates to the early web and only secures the connection, not the data
Qanapi assumes a breach will happen and encrypts data itself, down to individual words, paragraphs and database cells, rather than building a bigger perimeter
Each unit gets its own unique key
Every key is tied to an identity and a policy, not just handed out
A drone might need GPS position, altitude and its own hardware identity to all match before it gets a decryption key
The system covers data at rest, in transit and in use — including inside a live document — which Telford calls highly unusual
In a shared Google Doc, one reader can see a paragraph in plain text while another, without clearance, sees only encrypted text
The company's real product is stopping sensitive data from reaching public AI models at all, and proving where the data that does reach them came from
In a demo, Claude reports that it found certain fields but "couldn't read" them because they were encrypted
A key-sharding system built for drones in denied or jammed environments splits decryption keys and scatters the pieces physically — some in a Humvee, some in a soldier's backpack
Old key-sharding let an adversary who grabbed enough shards decrypt the payload; tying shards to identity and live conditions closes that gap
Encrypted data can move safely between AI agents, or even across an adversary's own network, because it stays useless without the matching identity and policy
Telford cited reports of AI agents from Anthropic and OpenAI reaching into Hugging Face as the kind of agent-to-agent risk this is meant to close
Telford says the company's own biggest weakness isn't the encryption — it's customers using weak passwords or credentials
His standard: not "100% bulletproof," but "99% better" than having no protection at all
1. The Wall Doesn't Work
Telford opened with how enterprise security has actually evolved, not how the industry describes it.
Early data security was just locking down ports and permissions. He recalled a hacker showing him how trivial it was to scan the internet for misconfigured Amazon S3 storage buckets and walk straight into a company's data: "it was amazing to me"
The industry's answer was a perimeter: a firewall with locked doors. But a wall only works from the outside. "As you point out, once you're inside the wall, you can see everything"
Telford's summary of the failure mode became the episode's most quotable line. "It doesn't matter how high you build the wall. The bad guys go get a bigger ladder." Or, he said, they find a loose brick at the base of the wall, crawl through, and put the brick back so nobody notices
The root cause, in his telling, is that the internet was never built to be secure. "The internet was never designed to be secure. It's actually designed to share information," going back to its DARPA origins. SSL — the browser padlock, which he credited to an early Marc Andreessen — only ever secured the connection, not the data moving across it
What followed was 25 to 30 years of retrofitting: more walls, more moats, better locks — "constantly chasing a tail." Smith connected that history to a new threat: AI models like Mythos and Fable that can scan a codebase from outside and find exploitable holes on their own
Smartphones and AI made the perimeter meaningless, because there is no longer a perimeter. Between smartphones since 2007 and now drones, autonomous systems and AI agents, he said, "these are borderless they are literally borderless there is no boundary." The old model of a bigger lock on the door, he said, is "in real trouble"
2. Assume the Breach
Qanapi's starting premise is the opposite of the industry's.
The company assumes a breach is inevitable, whether from an outside attacker or a trusted insider. Telford said that "nobody who's credible in cyber security that wouldn't say that it's not a matter of if it's when you get hacked or there's a data leak" — and that leaks are more often unintentional than intentional. The design also assumes "an Edward Snowden event": a fully trusted, credentialed insider who simply decides to expose data
Most encryption in use today doesn't actually protect the data itself. Files get encrypted as a wrapper, but the contents inside databases and cloud storage like S3 normally sit unencrypted, because systems need to read them to do their jobs
Qanapi encrypts at a far smaller unit than a file: individual words, paragraphs or, in a database, individual cells — each with its own unique key. In his account, nobody else had approached the granularity at that level before
3. Identity, Key, Policy
The harder problem, Telford said, wasn't the encryption itself but managing the keys.
His analogy is house keys. He asks people to consider that "when you walk out your front door in the morning Craig do you get 10 keys and just scatter them all over the footpath or hide them under the mat?" No — you hand a key to a specific, trusted person. Qanapi ties every decryption key to a verified identity, human or machine
On top of identity, the system layers conditions. A person might only get a key between 10 a.m. and noon; a drone might need its GPS position, altitude and hardware identity to all match before an encrypted payload unlocks. "GPS plus altitude plus drone identity equals yes"
Tying together identity, key and policy is, in Telford's account, the actual innovation. "Tying those three things together is unique and nobody else has done it"
4. Fathom: Down to a Word
The product line's naming follows a nautical theme, and the flagship AI-security product is called Fathom.
The AI-facing product is Fathom — named, Telford said, for the nautical term for sounding the depths to see what's below
It's delivered purely as an API, integrated into a customer's identity provider (he named Ping and Okta) so encryption happens transparently once it's wired in
A live demo runs inside Google Docs. With multi-level classification set up, a reader with top-secret clearance sees a given paragraph decrypted automatically; a colleague with only sensitive clearance sees the next layer down but not that paragraph
Decryption happens client-side, in the browser, never on Google's own servers. Telford said this matters for two reasons: a server-side decrypt would leave a trace in the document's edit history, and it would mean the plaintext briefly touched Google's infrastructure. Client-side decryption leaves neither footprint, and because there's nothing to install, it works "across mobile devices... across anything"
Whether encryption happens instantly or in bulk depends on the use case. A live gateway service encrypts on the fly at volume; a federal agency facing the government's post-quantum mandate — required between now and 2030 — can instead run a batch job across, say, a million existing files and encrypt the sensitive fields inside each one
5. All Three States of Data
Telford said covering data at rest, in transit and in use simultaneously is what makes the system unusual.
Data at rest is covered because the individual fields stay encrypted in storage, whether that's a database or S3. An insider who tries to walk out with a file just walks out with encrypted fragments
Data in transit is covered because the file can cross open, untrusted networks safely. Only the sections meant to be public are readable in the clear; everything sensitive stays encrypted end to end
Data in use is covered too — the harder problem. In a shared document with a hundred readers at different clearance levels, each person sees only what their credentials allow while the document is actively open, "which is highly unusual"
6. Stopping Leaks to AI
Much of the conversation turned to the specific risk of enterprise data reaching public large language models.
Telford's framing splits the problem into "negative provenance" and "positive provenance." Negative provenance blocks sensitive or classified data from ever reaching a public model — Anthropic, or any other provider — unless every policy check clears first. Positive provenance hashes and encrypts data with its origin identity at the moment it's created, so the receiving gateway can prove it came from a trusted source rather than, in his words, "poison data"
He used the 2023 incident in which Samsung employees pasted sensitive internal data into ChatGPT, which then surfaced elsewhere, as the scenario this is built to prevent. With Qanapi's encryption in place, he said, an equivalent leak would be useless because the sensitive fields would still be encrypted wherever they ended up
A live demo shows Claude declining to read protected fields. Telford said Claude reports, in effect: "I found this, this, this, and this. I couldn't read the data in this section because it appears to be encrypted with an encryption key" — and still returns results built from whatever data was left in the clear
The trade-off is real but narrow, in his telling. If the fields a company encrypts have nothing to do with the insight it's asking an AI model for — a customer's Social Security number has no bearing on a loyalty-program analysis, for instance — there's no loss of output quality at all
7. Echo: Keys for the Field
Smith, who had recently been near the front in Ukraine, pushed the conversation toward Qanapi's defense-specific product.
Drones and battlefield systems often can't trust a live network at all. Smith described a "denied, disrupted, intermittent" connectivity environment — the Pentagon's own term — where a drone might have Starlink at one moment, a government satellite link the next, or fall back to plain radio
If a payload isn't encrypted, an adversary can either read it or, worse, feed it false targeting data. And if the decryption keys themselves travel with the drone or over the network, capturing them defeats the encryption entirely
Qanapi's answer, the Echo product, breaks a decryption key into physical pieces and distributes them on the ground — some shards in a vehicle, some in an operator's backpack at a forward operating base. A drone requesting a key has to present its identity and meet live conditions (GPS, altitude and more) before enough shards recombine to unlock a specific payload
Key sharding itself isn't new — it's about 20 years old — but the old version had a hole. If an adversary captured enough shards to clear the reassembly threshold, they had the key. Tying each shard to identity and live, verified conditions closes that gap: "nobody even comes close to achieving that," Telford said
The same architecture, he said, works over any carrier, including an adversary's own infrastructure. An encrypted payload can cross a hostile telecom network and still be useless without the right combination of identity and conditions on the receiving end
He sees the same problem extending well beyond drones, to undersea vehicles, autonomous ground systems, and eventually humanoid robots: "How you going to protect the data to stop the robot turning into an awful sci-fi movie and, you know, doing all the bad things they can do?" — calling it a huge problem that hasn't been solved
8. Agents and the Weak Point
The conversation closed on newer risks — AI agents passing data to each other — and where Telford thinks his own system could actually fail.
Smith raised reported cases of AI agents from Anthropic and OpenAI reaching into Hugging Face and pulling data without the companies immediately noticing, as an example of agent-to-agent risk that doesn't run through a single model provider
Qanapi has started seeing customers apply the same encryption to agent-to-agent handoffs, not just agent-to-model traffic. One agent can decrypt only the subset of a shared, encrypted dataset that its own credentials and policy allow, even when several agents are all drawing from the same original source
The company holds FedRAMP High certification with the US federal government, and Telford said Qanapi has run its own system against red-teaming tools with capability similar to Mythos, plus another tool he wouldn't name
Telford was candid about where the actual risk sits: not the encryption, but the customer's own credentials. "If you use poor identity and poor credentials... the system's still going to give you a green light being frank" — comparable, he said, to a bank forcing a complex password because a simple one is the customer's fault, not the system's
His standard isn't perfection. He said anyone claiming their system is 100% bulletproof should prompt you to leave the room immediately, and framed the honest pitch as roughly 99% better than the alternative of having no protection at all
He drew a contrast with rival tools that strip sensitive fields out of a dataset rather than encrypting them in place. Separating the data breaks its chain of provenance, which he said is a real problem in regulated fields like medical research, where an institution has to prove the data an AI model trained on wasn't altered. Because Qanapi encrypts fields without removing them, the original dataset can be sent back intact, encrypted pieces and all
Bonus Insights
The business is priced on consumption, similar to AI tokens themselves. Qanapi charges enterprise customers a percentage of the tokens their data uses passing through the gateway; larger enterprises typically also pay a platform fee. Telford said customers like tying security spend to their AI budget as a predictable percentage rather than a separate line item
Growth has "exploded" in the last six months, as enterprises realized — after roughly two and a half to three years of mainstream AI adoption — how exposed their data actually is
Qanapi has a partnership with Nvidia and runs on Jetson edge devices, and Telford said the major foundation-model labs have validated the company rather than building the capability themselves, because a neutral, model-agnostic layer serves their own enterprise customers better than a proprietary one would
Capital isn't the constraint — hiring is. Telford said Qanapi sits at the intersection of AI security, post-quantum cryptography and defense technology, which makes fundraising easier than finding people fast enough to grow the team
He also explained the platform's other geography-themed naming: the core API platform is called Cast, after the geological term for water finding its way through mountains, because the system is meant to work anywhere
Telford's bottom line is that the industry spent three decades building better walls around data that was never protected in the first place, and encrypting the data itself — tied to identity and policy rather than just a perimeter — is what actually closes the gap AI and autonomous systems have blown open.
Products, Companies & Tools Mentioned
Qanapi (Telford's company. Its Fathom product secures AI data flows, Echo handles key-sharding for drones and disrupted networks, and Cast is the underlying API platform)
Okta and Ping Identity (The identity and multi-factor authentication providers Qanapi integrates with to tie encryption keys to a verified identity)
Anthropic (Named both as a public model Qanapi's gateway can block sensitive data from reaching, and, via Claude, as the model shown in a live demo declining to read encrypted fields)
Nvidia (Qanapi's partner for running its system on Jetson edge devices)
Hugging Face (The platform Smith said AI agents from Anthropic and OpenAI were reported to have reached into without their operators immediately noticing)
If this was worth your time, send it to someone closer to the industry than you are.
Get the latest market chatter as it happens: