Stan Mesceda | Sr. Product Manager
More About This Author >
Stan Mesceda | Sr. Product Manager
More About This Author >
As AI and distributed infrastructure accelerate data movement, organizations must protect not only high-volume traffic but also long-life, high-value information that may remain sensitive for decades.
Connectivity is becoming a question of trust, not just reach
AI is changing where data is created, processed and consumed. Training datasets may move between enterprise repositories and GPU clusters; inference services may depend on data distributed across cloud and edge locations. Data center interconnect also carries replication and recovery traffic between sites. But the challenge is not simply how much data moves or how fast: it is also what that data contains. Proprietary research, intellectual property, personally identifiable information (PII), sensitive government records, financial information and critical infrastructure data can retain significant value long after a particular transfer is complete.
This creates tension due to misaligned goals. The business expects flexibility to establish new connections and move workloads quickly, but security teams need to know how data is protected between endpoints, which policies apply and who controls the encryption keys. For regulated organizations, those questions become more complicated as traffic crosses cloud-provider and jurisdictional boundaries.
The long-term picture matters too. Some sensitive information must remain confidential for years or decades. With “Harvest Now, Decrypt Later”, adversaries capture and retain encrypted traffic today with the intent of exploiting the information in the future when quantum computing is available. The useful life and sensitivity of data, not just network volume, should shape encryption decisions and post-quantum migration priorities.
The opportunity is to treat private interconnection, encryption and operational control as complementary parts of a trusted connectivity model.
Why the old operating model struggles to keep pace
The first requirement is consistency. Different clouds, colocation environments and WAN segments often come with different networking infrastructure and security controls. An organization may be able to encrypt individual connections yet still struggle to maintain a coherent policy across the full journey of data. Security teams should ask where encryption begins and ends, how keys are governed and whether responsibilities for network routing and cryptographic administration can be separated.
The second requirement is responsiveness. A new AI workload, acquisition or disaster recovery location can change connectivity needs quickly. Deploying dedicated appliances in every location introduces procurement, shipping and installation steps that may not match the pace of software-defined infrastructure. Virtualized network functions offer another deployment option, particularly where infrastructure is needed close to cloud on-ramps and interconnection points.
Third, performance cannot be an afterthought. Data replication, analytics and AI pipelines can be sensitive to throughput, latency and network overhead. Encryption design therefore needs to protect high-volume traffic efficiently while applying appropriate safeguards to smaller flows containing especially sensitive or long-lived information.
Finally, sovereignty should be understood as more than physical data location. Organizations also need to consider who sets security policies, who can administer cryptographic keys and how data is protected as it travels between environments. Customer control over these elements can support governance objectives, though specific residency and compliance obligations still require assessment for each deployment.
These considerations point toward a practical principle, secure your critical data paths with best practices and independently validated solutions that can encrypt across a wide range of today’s modern infrastructures.
How Equinix and Thales bring the layers together
Equinix Fabric provides the software-defined interconnection layer. It enables private, on-demand connections between distributed enterprise infrastructure, cloud environments and service providers. Rather than treating every new connection as a separate physical-network project, organizations can provision and adjust virtual connectivity through a portal or APIs. This helps make interconnection responsive to changing workload needs.
Thales CV 1000 as a virtual network function on Equinix Network Edge adds a virtual deployment environment at interconnection points. Organizations can deploy network functions without first shipping and installing dedicated appliances at each location. This is especially useful when security controls need to be positioned near cloud access points or linked with other virtual network functions.
Thales applies a FIPS-certified, post-quantum ready encryption overlay to Fabric connections, protecting data in motion across multi-cloud, SD-WAN, AI, and large dataflow use cases without the latency and overhead of legacy protocols. Thales CV1000 is a virtual network function designed to protect data in motion with high-throughput, low-latency encryption. Its approach supports customer control over cryptographic keys and policies, separation of encryption from routing functions, and crypto-agile planning for evolving post-quantum requirements.
Together, Thales and Equinix deliver a trusted, sovereign, high-speed network encryption interconnection fabric that combines global reach, on-demand provisioning, and certified quantum-ready encryption, giving enterprises a single platform for secure cloud connectivity, hybrid AI workloads, and SD-WAN.
This approach can reduce dependence on site-by-site hardware deployment and help teams apply more consistent cryptographic controls across hybrid and multi-cloud connections.
What this looks like in practice
Consider an enterprise building an AI pipeline that moves sensitive data between a private data center, cloud storage and a remote compute environment. Private interconnection can provide a flexible path for moving data, while encryption helps protect proprietary training datasets, model assets and other high-value information in transit. These assets may require lasting confidentiality even after the immediate training or inference task ends.
A second example is a multinational organization connecting applications across multiple cloud providers. Each provider may have its own native security mechanisms. Applying a customer-controlled encryption policy across selected interconnections can help create a more consistent approach to data-in-motion protection, independent of the cloud environments involved.
A third example is data center interconnect for backup, replication and disaster recovery. These flows often involve large amounts of sensitive data that require consistent encryption, controls and customer-owned/managed keys. These data flows can also contain archives, customer records and intellectual property with long retention periods. Software-defined interconnection and encryption can address both the operational need to move data efficiently, and the security and resilient multi-site connectivity required to protect its enduring value.
For network architects evaluating this model, the starting questions are straightforward: Which data flows require end-to-end protection? Where should encryption terminate? Who should control keys and policies? What are the workload’s latency and bandwidth requirements? And how can the design evolve as cryptographic standards change? Answering those questions early makes it easier to choose an architecture that meets both business and security objectives.
Private interconnection and customer-controlled encryption together
The next phase of digital infrastructure will be shaped by distributed AI, growing expectations for control over sensitive data and the need to prepare for changing cryptographic standards. Protecting data in motion means accounting for its volume, its value and how long it must remain confidential. A trusted connectivity strategy should be designed for all three.
By combining Equinix Fabric, Equinix Network Edge and Thales CV1000, organizations can explore a software-defined approach to private interconnection with customer-controlled encryption. To see how the architecture can support your environment, review the Thales–Equinix joint solution brief.