According to an example, a hybrid secure non-volatile main memory (HSNVMM) may include a non-volatile memory (NVM) to store a non-working set of memory data in an encrypted format, and a dynamic random-access memory (DRAM) buffer to store a working set of memory data in a decrypted format. A cryptographic engine may selectively encrypt and decrypt memory pages in the working and non-working sets of memory data. A security controller may control memory data placement and replacement in the NVM and the DRAM buffer based on memory data characteristics that include clean memory pages, dirty memory pages, working set memory pages, and non-working set memory pages. The security controller may further provide incremental encryption and decryption instructions to the cryptographic engine based on the memory data characteristics.