If you've been running AMD Ryzen processors in your organisation's workstations, home labs, or edge computing setups and assumed your RAM was hardware-encrypted, you need to read this immediately. AMD has quietly stripped a critical security feature from its consumer-grade CPUs — and it did so without telling anyone. Here's what happened, why it matters, and what you should do about it right now.

What Happened? AMD's Silent Removal of TSME

AMD has quietly removed a security feature from its consumer Ryzen processors without telling customers. The protection, called Transparent Secure Memory Encryption (TSME), scrambles everything held in system memory so an attacker with physical access reads only noise.

AMD has silently disabled this security feature on its consumer Ryzen processors that protected users against physical attacks on their computer's memory. TSME encrypts all data stored in RAM using a hardware-generated key that changes on every boot. When active, it renders cold boot attacks, DRAM interface snooping, and physical memory module removal useless because the extracted data is encrypted.

The discovery came in April 2026.

The change was first discovered by Ben Kilpatrick, a privacy-focused Linux user who was installing a new operating system on a machine running a Ryzen 7 9700X, part of AMD's Zen 5 architecture.

He ran Host Security ID (HSI), a tool that audits firmware and hardware security settings, to confirm his protections were active — and one line stopped him: "Encrypted RAM" showed as not supported.

Investigators found that consumer Ryzen chips on MSI and Gigabyte boards kept TSME working under an older firmware delivered through AGESA, AMD's firmware framework. Swap to a newer release, version 1.2.7.0, and TSME reported as not supported. PRO Ryzen chips kept the feature across both boards and both firmware versions.

Understanding TSME: What You've Just Lost

To understand the gravity of this situation, it's worth stepping back and looking at exactly what TSME does and why it matters.

The feature, sometimes marketed as AMD Memory Guard, works by generating an encryption key at boot through AMD's Secure Processor. Every byte written to RAM gets encrypted transparently, with no operating system involvement required.

This technology encrypts all system memory using a single cryptographic key. The AMD Secure Processor generates this unique key during the boot sequence, and this key never leaves the secure silicon environment. Consequently, the encryption process remains completely transparent to the operating system and applications.

This is fundamentally different from software-based encryption solutions. There's no performance overhead from the OS, no key stored on disk, and no way for a malicious application to interfere. It just works — or rather, it used to work.

TSME vs. SME: Two Different Technologies

It's important not to confuse TSME with AMD's other memory encryption offering.

Secure Memory Encryption (SME) is OS-managed and uses a single key to selectively encrypt individual memory pages.

In contrast, TSME operates at the firmware level and encrypts the entirety of system RAM without requiring intervention from the operating system.

AMD has long stated that SME is available only in its Pro and EPYC CPU tiers, leaving consumer users without an officially supported hardware memory encryption path.

This is the critical distinction: with TSME now gone from consumer CPUs, there is no equivalent hardware-level fallback for non-PRO Ryzen users.

A Years-Long Grey Area — and AMD's Contradictions

The story here is more complex than a simple product decision.

The controversy stems from a years-long discrepancy between AMD's official stance and the actual behavior of its consumer processors. In a 2020 GitHub discussion thread, AMD engineer Lendacky stated that the Ryzen 3700X "should support TSME." Users subsequently confirmed that the feature worked on numerous non-Pro, non-EPYC CPUs when the appropriate BIOS option was exposed by motherboard vendors.

In a 2025 follow-up within the same thread, Lendacky clarified that while the hardware might be capable, the feature is ultimately a BIOS option that must be exposed by the motherboard manufacturer or the BIOS provider. This distinction highlights a gap between silicon capability and official product support policies.

This is not a flaw being discovered — it is a working feature being withdrawn. AMD never formally advertised TSME as available on consumer Ryzen chips. But the feature worked, AMD's own engineers confirmed it worked, and users built their security posture around it. The change arrived through a routine AGESA firmware update with no release note, no advisory, and no way for Windows users to detect it.

Perhaps most tellingly,

the silicon in both consumer and PRO processors is identical. The restriction is enforced entirely in firmware. The consumer Ryzen chip is physically capable of encrypting memory but is being told not to.

The Real Security Implications for Enterprise Users

This isn't just a consumer concern. Many organisations deploy standard Ryzen chips in workstations, developer machines, and even small-office servers to save costs. If your security architecture assumed TSME was active, you now have a gap.

Physical Attack Surface Just Got Wider

For users who previously relied on TSME to mitigate physical memory risks, the removal necessitates a re-evaluation of their security posture. Since TSME provides protection against memory module removal and physical snooping, its absence leaves a gap for those operating in high-threat physical environments.

For anyone running validator nodes, staking infrastructure, or operations on AMD-based hardware, the absence of memory encryption means that physical access to the machine could potentially expose private keys, seed phrases, or session tokens that happen to be in memory. This is especially relevant for operators in co-located data centres where physical security is shared rather than absolute.

The Detection Problem

One of the most alarming aspects of this change is how difficult it is to detect.

The feature was removed at the hardware level, meaning no software toggle could bring it back. And detecting whether TSME is active on a Windows machine turns out to be surprisingly difficult, potentially requiring Linux-based tools or specialised diagnostic checks to confirm.

This means that systems administrators running Windows-based fleets may have had their memory encryption silently disabled without any alert, log entry, or warning in a security dashboard.

The Competitive Landscape Shifts

Rival Intel ships total memory encryption broadly across its modern chips, which makes AMD's PRO-only stance look like a deliberate nudge toward pricier hardware for security-minded buyers.

This changes procurement calculus significantly for security-focused organisations.

For enterprises that specifically chose AMD over Intel partly because of available hardware-level memory encryption on accessible price points, this removal erodes a key differentiator.

What AMD Has (and Hasn't) Said

AMD's official response has been frustratingly sparse.

The company excluded this significant change from their release notes and failed to provide any official public explanation. When journalists investigated, representatives claimed TSME belongs exclusively to the AMD PRO technology suite.

Officially, AMD never explicitly promised TSME support for consumer Ryzen chips. Nevertheless, the reality remains that users enjoyed these capabilities for years.

The primary frustration for users is the lack of transparency regarding whether this removal is a deliberate security hardening measure or an accidental firmware regression. Security specialist Joe Fitzgerald argues that AMD owes its user base a definitive explanation.

The question posed to AMD's engineers remains unanswered: is this a bug or a business decision?

Until AMD answers that definitively, security teams cannot plan appropriately.

What's Still Available: The PRO and EPYC Path

If hardware-level memory encryption is non-negotiable for your use case, AMD does still offer the technology — just not on consumer SKUs.

The EPYC 9005 series offers Secure Memory Encryption plus Secure Encrypted Virtualization (SEV), SEV Encrypted State, and SEV-Secure Nested Paging security features.

These are enterprise-grade protections designed for data centre workloads, VM isolation, and cloud infrastructure.

Secure Encrypted Virtualization (SEV) integrates main memory encryption capabilities with the existing AMD-V virtualization architecture to support encrypted virtual machines, helping protect them from physical threats, other virtual machines, and even the hypervisor itself.

For business workstations specifically, the Ryzen PRO line retains TSME.

For teams that already track enterprise security tooling closely, the takeaway is plain: verify what each SKU actually enables rather than trusting past behaviour.

Practical Tips: What You Should Do Right Now

This situation calls for immediate, concrete action. Here's your checklist:

Consumer Ryzen chips on MSI and Gigabyte boards kept TSME working under an older firmware delivered through AGESA. Swap to version 1.2.7.0, and TSME reports as not supported.

If you are below 1.2.7.0, consider delaying the update pending further investigation.

TSME's absence leaves a gap for those operating in high-threat physical environments.

Strengthen physical security policies — server room access logs, cable locks on workstations, and strict visitor controls.

TSME no longer switches on for consumer Ryzen chips even when the BIOS enables it.

A toggled BIOS setting is not confirmation of active protection. Verify at the OS level.

The Bigger Picture: Trust, Transparency, and Hardware Security

This incident exposes a broader and troubling pattern in the hardware industry.

The episode is one more reason managing security risk keeps getting harder — a feature that worked for years can vanish from a product line overnight, with no changelog entry to mark its exit.

Security teams have always been told to verify, not trust. But hardware is typically the one layer assumed to be stable — the foundation everything else builds upon. When that foundation changes silently through a firmware update, the principle of least-surprise is violated in the worst possible way.

For enterprise buyers, this is ultimately a procurement and vendor-management lesson as much as a technical one. Security feature sets must be validated per SKU, per firmware version, and periodically re-verified — not assumed to be permanent because they worked last quarter.

Conclusion: Protect Your Systems Before AMD Answers

AMD's silent removal of TSME from consumer Ryzen processors is a significant security event that every IT professional, security engineer, and system administrator should take seriously. Whether this turns out to be a firmware bug, a deliberate product segmentation strategy, or something else entirely, the practical reality is the same: if you're running non-PRO Ryzen hardware, your RAM may no longer be hardware-encrypted — and you likely had no idea.

Don't wait for AMD to issue a formal explanation or a patch. Audit your fleet, verify protection status on every affected machine, and begin planning compensating controls today. If your workloads are sensitive enough that memory encryption is a compliance or risk requirement, start your migration planning to AMD PRO, EPYC, or Intel TME-capable hardware immediately.

Want to stay ahead of critical hardware security developments like this one? Subscribe to our newsletter for weekly deep-dives into CPU security, enterprise infrastructure, and actionable threat intelligence — delivered straight to your inbox before the headlines hit.