Arm is extending automated hardware security assurance across additional processor programmes, expanding its use of Arteris technology to identify weaknesses during architecture, design, and pre-silicon verification.
The Cambridge-based processor company is widening its deployment of the Cycuity Radix platform, which analyses how sensitive information moves through a semiconductor design and traces potential vulnerabilities to the components, interfaces, or control paths from which they originate. Engineering teams can examine security properties before physical silicon is produced, when changes remain considerably less disruptive than after tape-out.
As processor architectures combine CPU cores, accelerators, memory controllers, interconnects, security blocks, and third-party intellectual property, weaknesses increasingly emerge from interactions between otherwise valid components. A block may behave correctly in isolation yet expose information or bypass an intended control when connected to a different memory hierarchy, privilege structure, or system interface.
Radix supports architectural risk assessment as well as automated verification, allowing security requirements to be expressed as properties that can be checked repeatedly while the design evolves. Those checks can cover unauthorised information flow, access-control behaviour, privilege separation, and whether sensitive data can reach parts of the system that were not intended to receive it.
Discovering a hardware weakness after manufacture can force firmware restrictions, product recalls, redesign work, or a new silicon revision, while customers may need to alter software and operating procedures around a component already installed in field equipment. The financial consequences extend well beyond the semiconductor supplier when processors sit inside vehicles, industrial controllers, communications infrastructure, defence systems, or cloud platforms.
By carrying security checks further into the normal verification process, Arm can reduce the separation between functional validation and security assurance. Conventional verification establishes whether a processor performs its intended operations under defined conditions; security analysis examines whether the same architecture can be manipulated into exposing information, granting unintended access, or entering an unsafe state.
Manual review remains essential, although contemporary processor designs contain too many interacting states and data paths for engineers to investigate every condition directly. Automated methods provide broader and more repeatable coverage, provided the underlying threat models and security properties accurately represent the architecture and its intended deployment.
Reuse across processor families could also reduce duplicated engineering work. Where a security requirement applies to several cores or system configurations, a verified property can be retained and checked again as interfaces, accelerators, and memory structures change. Teams can then concentrate on new architectural risks without rebuilding the complete assurance process for each programme.
Hardware security has become more closely tied to commercial qualification as processors move into connected machinery, edge AI systems, vehicles, medical devices, and critical infrastructure. Customers increasingly request evidence covering secure boot, trusted execution, memory protection, privilege management, and resistance to unauthorised access, particularly where equipment will remain operational for many years.
Long product lifecycles place further pressure on the original design. A processor integrated into industrial or defence equipment may remain in service long after mainstream software, manufacturing processes, and attack techniques have changed. Recent examination of semiconductor strategy in long-life defence electronics has shown how trusted component selection, controlled design routes, and sustained technical support now influence platform availability as much as initial device performance.
Reusable semiconductor intellectual property creates its own assurance challenge. Reuse shortens development cycles and reduces the need to redesign established functions, but it may also carry assumptions from one product into another. A security block created for one system can behave differently when attached to a new interconnect, management processor, or memory controller, particularly if privilege boundaries have changed.
Architecture-level information-flow analysis exposes those interface conditions before they become fixed in silicon. It can also produce evidence showing how a vulnerability was identified and resolved, strengthening design reviews and giving customers a clearer basis for assessing whether security requirements have been met.
Automation does not remove the need for experienced verification and security engineers, because tools cannot determine whether an incomplete requirement reflects the intended system. Results still need to be interpreted against the processor’s operating environment, software stack, and likely threat conditions, while design changes must be reviewed to ensure that earlier assumptions remain valid.
As AI acceleration, connectivity, virtualisation, and embedded security functions increase processor complexity, the cost of late vulnerability discovery will continue to rise. Arm’s expanded use of automated assurance places more of that work at the stage where architectural changes remain possible, rather than after manufacturing and customer qualification have already committed the design.
