IBM have a solution for that... it's called secure service container, and it's made exact to make sure that even IBM engineering itself cannot extract anything from the VM

the downside is that if you lose your keys, it's a self-inflicted ransomware

it have changed a little since I worked with it, but it uses a special extension card (the Crypto Express Card) to create and store a private key. this key never ever leaves the card, and every decrpt operation runs inside it.

it's a bit limited because it's engineered to run containers (docker or kubernetes), so you have to create an image, and deploy it on the SSC (secure service container). it does not have any interface to the OS, and all storage and memory are encrypted using that private key, and cannot run anywhere else

so even if IBM took a snapshot of the container, it would be encrypted with a key inside an HSM with the highest security rating available, used by (I have to say almost) every large bank out there

the downside is that it only runs on IBM LinuxONE servers, and they aren't x86. It's a s390x architecture, but it runs Linux pretty well, and if your application runs on Linux, you can compile it usually without changing anything at all. just configure, make, and done

and by "pretty well" I mean unless someone tells you that this linux isn't x86, you don't see a difference.

usually "why my shellcode isn't working?" is the question when you know something is different

Found the best quote out there: "Your security is weaker than my will to live"

I feel like this needs to be on the risk ratings, or the security status of an organization.