Security moves below the operating system as AI PCs take on the data protection job

Chipmakers and device makers are rebuilding enterprise data loss prevention around on-device AI security, as employees paste sensitive material into chatbots and assistants faster than rules-based tools can inspect it. Nearly 40% of all data moving into AI tools now involves sensitive material, according to a 2026 Cyberhaven report. The shift pushes classification off the cloud and down into silicon, where models can run cheaply and data never leaves the endpoint.

That change depends on a stack that reaches beneath the operating system, from the neural processing unit through firmware and the boot sequence. Chipmakers and device manufacturers are now feeding hardware telemetry into the same console security analysts already use, according to Todd Cramer (pictured, left), senior director of business development and security ecosystem at Intel Corp.

“This year, we have Falcon data security from CrowdStrike announcing their first AI model that runs on an Intel NPU on a Dell device,” Cramer said. “It’s the right time in the use case, because we’ve got all these AI assistants, chatbots. What’s the first thing CISOs are worried about? Data.”

Cramer and Lori Zwilling (right), senior director of software product management at Dell Technologies Inc., spoke with theCUBE’s Rebecca Knight and Dave Vellante at Fal.Con 2026, during an exclusive broadcast on theCUBE, SiliconANGLE Media’s livestreaming studio. (* Disclosure below.)

Why on-device AI security needs hardware telemetry

The pitch rests on a simple gap: traditional security software sits above the operating system, while adversaries now target firmware and silicon as regularly as software layers. Dell’s hardware-assisted detections surface signals that endpoint and cloud tooling never sees.

“Adversaries are also moving below the operating system, into the silicon, into the hardware, into the memory,” Zwilling said. “We believe you need hardware to fight hardware-level threats. They’re going to see things like BIOS integrity status. They’re going to see firmware tampering alerts.”

The same layered logic drives the companies’ post-quantum readiness work, which extends from firmware signing to the Intel boot sequence, Zwilling noted. Both partners argue the coverage has to stretch from the client device all the way into AI infrastructure.

“Not only are analysts seeing the endpoint behavior, but they also can see what’s happening with AI models, the data, the inferencing, the actual containers, the compute that’s powering the AI for the enterprise,” Zwilling said. “So we’re talking about full-stack AI security now.”

Stay tuned for the complete video interview, part of SiliconANGLE’s and theCUBE’s coverage of Fal.Con event.

(* Disclosure: TheCUBE is a paid media partner for the Fal.Con event. Neither CrowdStrike, the sponsor of theCUBE’s event coverage, nor other sponsors have editorial control over content on theCUBE or SiliconANGLE.)

Photo: SiliconANGLE