What AMD TSME Encryption Is and Why It Matters
AMD TSME encryption, or Transparent Secure Memory Encryption, is a processor feature that automatically encrypts all data stored in system memory to reduce the risk of physical attacks, such as cold‑boot attacks, that try to extract sensitive information directly from RAM. Unlike software-based encryption, TSME runs below the operating system and applies to everything in memory, including system processes and applications, without user interaction. AMD first brought this capability to higher-end processors and later extended it to more mainstream Ryzen desktop CPUs, making Ryzen memory security a selling point for privacy-conscious users. Because TSME works at the BIOS and firmware layer, changes to BIOS update security policies can silently enable or disable it. That is exactly what sparked the recent backlash around the Ryzen 9000 series and their protection against physical attack protection threats.
How a BIOS Update Quietly Removed Ryzen Memory Security
The controversy began when AMD’s AGESA 1.2.7.0 firmware removed the BIOS option tied to TSME on some non‑Pro Ryzen 9000 processors without public notice. According to PCMag, the feature remained in older firmware, but systems updated to the new code lost the switch to enable what AMD markets as Memory Guard on these chips. Linux hobbyist Ben Kilpatrick discovered the change while auditing a fresh install on a Ryzen 9700X and found that TSME was reported as “not supported,” even though earlier BIOS versions had exposed it. He spent months trading bug reports and emails with motherboard vendor MSI and AMD engineers before learning that, officially, AMD now considered TSME reserved for Ryzen Pro models. This silent regression in Ryzen memory security raised concerns about BIOS update security practices and communication.
Backlash, Reversal, and AMD’s July BIOS Update Promise
Once Kilpatrick’s findings spread through enthusiast and security communities, criticism focused less on the risk level and more on AMD’s lack of transparency. Wccftech notes that even motherboard makers were unaware that the TSME option had been removed until users complained. While the attack TSME helps defend against requires physical access to a machine, losing that protection without warning undermined trust. In a statement to PCMag, AMD admitted that a BIOS option for Memory Guard on some non‑Pro Ryzen 9000 processors “was previously available but was removed in a recent update” and said that “based on valuable community feedback, we will reinstate this option in an upcoming BIOS release in July.” The company also stressed that TSME remains a “foundational security feature” for its Ryzen Pro lineup.
A Growing Divide Between Consumer and Pro Ryzen Security
The incident highlights a widening divide between consumer Ryzen and Ryzen Pro security features. While Ryzen Pro processors retain full TSME support and AMD says it has “no plans to remove” it there, mainstream users saw the option disappear, then reappear only after public pressure. That creates a perception that key protections like physical attack protection are now tiered features, rather than baseline safeguards. For organizations and power users, this raises questions about long-term support for AMD TSME encryption on non‑Pro chips and whether future BIOS update security changes could again downgrade protections without clear notice. It also shows how much hardware security now depends on opaque firmware choices, where a single AGESA revision can quietly change how well a system defends its memory against hands-on attacks.
What Ryzen Users Should Do Next
If you own or plan to buy a non‑Pro Ryzen 9000 desktop CPU, the next step is to watch for the July BIOS releases from your motherboard vendor that reintroduce the Memory Guard or TSME toggle. Once available, update your BIOS carefully, then enter the firmware setup and confirm that AMD TSME encryption is enabled, particularly if you travel with your PC or handle sensitive workloads that might be exposed to physical access. Users on older firmware where TSME is already available may choose to wait for the reinstating update rather than move to AGESA 1.2.7.0 builds that removed the option. More broadly, this episode is a reminder to read motherboard changelogs, archive working firmware, and treat security-related BIOS options as part of your regular audit checklist for Ryzen memory security.
