Building Secure Chips: Why Hardware Security Assurance Is Now Essential

By Arteris

March 26, 2026

Traditional verification is no longer enough, so what are leading companies doing to bring measurable security assurance into chip development?

At DAC 2025, the panel discussion, ‘Building Secure Chips Without Jeopardizing Design Budgets and Schedules,’ brought together experts from Meta, Marvell, Booz Allen Hamilton, Arm, and Cycuity to discuss a topic that is rapidly becoming a top priority for semiconductor teams: hardware security assurance.

The discussion focused not just on new technologies, but on the organizational, business, and methodological changes required to make hardware security a practical and integral part of modern silicon development.

The Technology Challenge: A Rapidly Expanding Hardware Attack Surface

One of the central themes of the panel was that hardware security challenges have expanded dramatically in recent years. The discovery of advanced micro-architectural exploits, such as Spectre and Meltdown, revealed that vulnerabilities could exist deep inside hardware implementations, beyond the reach of traditional verification approaches.

“Hardware security, the big hacks like Spectre and Meltdown … the Bloomberg article on devices being inserted in the supply chain” were highlighted by Mark Labbato of Booz Allen Hamilton, who referred to the wakeup call that “kicked off a lot of research and development in the DoD space.”

At the same time, modern SoCs now integrate far more security functionality than in the past, including secure enclaves, cryptographic engines, hardware roots of trust, and access control mechanisms. While these features strengthen system defenses, they also introduce new opportunities for design flaws if they are not implemented correctly.

While traditional verification focuses on confirming that a design behaves according to specification, security verification must also identify behaviors that should never occur. These include unintended information flows, privilege escalations, or hidden data leakage paths.

Rachana Maitra of Marvell emphasized how different hardware security validation is from traditional verification: “Traditional validation does not even scratch the surface of product security because it’s vastly different. We’re looking for something beyond spec. The tool set, the mindset, the strategy; everything has to be different.”

The Business Driver: Why Hardware Security Is Now a Strategic Requirement

The panel also highlighted that the growing focus on hardware security is being driven by clear business realities. Unlike software vulnerabilities, which can often be patched after deployment, hardware flaws discovered late in the product lifecycle can carry enormous costs.

A vulnerability discovered after tape-out can require redesign, costly mitigation, or even product recalls. The reputational impact can be equally severe.

“When I joined Meta, it was not a matter of ‘let’s do it good enough,’” explained Maurizio Paganini of Meta. “We were coming out of a period with the elections that there were questions about the integrity of the business, so there was a strategic association of security, safety and privacy to the brand of the company and we didn’t put a cost target to it.”

Industry pressure is also increasing due to compliance requirements, emerging regulations, and supply‑chain security concerns. Semiconductor vendors must now demonstrate that their designs are secure not only internally, but also across the ecosystem of third‑party IP and design partners.

Vikram Khosa of Arm talked about cybersecurity “concerns from our partners,” which in turn are “putting a lot of pressure on us, too,” with “a lot of scrutiny on security. And that’s part of it. Of course, then there’s a lot of research and errata that the research community has been finding.”

This pressure comes from multiple directions, including customers, regulators, research communities, and system integrators. All are demanding stronger evidence that silicon is secure before it reaches production.

From left to right: Moderator – Andreas Kuehlmann. Panelists – Vikram Khosa, Mark Labbato, Rachana Maitra and Maurizio Paganini

Organizational Reality: Security Must Become a First‑Class Requirement

A consistent message from panelists was that improving hardware security requires more than new tools. It requires treating security as a core product requirement, alongside functional correctness, power, performance, and area.

Security initiatives often fail when they are treated as optional add‑ons late in development cycles. Instead, panelists emphasized the need for organizational alignment, executive sponsorship, clear accountability, and system-level ownership.

“In the end, it’s not something that only one team can contribute to or make sure it’s fully covered. It’s really the full system, the full product,” said Maurizio Paganini of Meta. “We have started a series of initiatives internally to relook at how we manage security and we open up windows of access in a very conscious way and integrate better hardware and software security together.”

This reflects a broader shift occurring across the industry that hardware security is no longer the responsibility of a single team. It requires collaboration across architecture, design, verification, firmware, and system integration.

Process: Shifting Security Earlier in the Design Lifecycle

Another major takeaway from the DAC discussion was the importance of integrating security early in the development lifecycle, often referred to as “shift left.”

By identifying assets, attack surfaces, and trust boundaries during architectural planning, teams can avoid costly design changes later in development. Several panelists described how organizations are introducing secure development lifecycle (SDL) processes that require security reviews, threat modeling, and verification activities to occur before designs are finalized.

“For my space, it’s really driven by the threat model of the devices and where they go and where the systems live,” said Booz Allen Hamilton’s Mark Labbato. “What are the security policies in place to prevent the data from being exfiltrated, for example, or critical signals being impacted that cause it to malfunction in a very bad way that you would not want to happen … making sure that those policies are put in place very early and hammered on throughout the design and development process.”

Mark added that consequently SoC designers increasingly “take the extra steps early, even if they’re not being required,” as all see that it is coming their way soon.

Methodology and Technology: Enabling Evidence‑Based Security Assurance

From a technology standpoint, the panel emphasized the need for scalable methodologies capable of analyzing complex SoC designs. Traditional verification techniques alone are not sufficient for discovering subtle security vulnerabilities.

“We’re looking for something that should not happen, something beyond spec and we need specialized tools for this,” explained Rachana Maitra of Marvell.

This shift is driving the adoption of new security‑focused verification methodologies and technologies, including asset‑based analysis, information‑flow tracking, vulnerability scanning against known CWE classes, and formal security verification methods.

These approaches enable teams to move from intuition‑driven security reviews toward evidence‑based security assurance, a key step in building confidence in modern hardware platforms.

The Cycuity Perspective: Turning Security Into Measurable Assurance

From the Cycuity perspective, the DAC panel reinforced an important reality: hardware security is evolving from an informal design concern into a measurable engineering discipline.

As attack surfaces expand and supply chains become more complex, organizations must adopt methodologies that identify security assets, verify security policies, and demonstrate compliance with emerging standards and certification frameworks. Doing so requires a combination of business commitment, organizational alignment, robust processes, and advanced verification technologies capable of analyzing security properties across entire SoC designs.

The conversations at DAC 2025 made it clear that the industry is still early in this journey. But the direction is unmistakable: hardware security assurance is no longer optional. It is rapidly becoming a foundational requirement for building trustworthy silicon.

As DAC panel moderator Andreas Kuehlmann observed: “Security is seldom a business goal in isolation. It rather serves as the means to support key objectives, such as safety, privacy, and data protection. In essence, security assurance provides a foundational layer to support a broad set of business goals.”

Explore NoC IP:

• Smart Network-on-Chip (NoC) IP
• FlexNoC 5 Interconnect IP
• FlexNoC Functional Safety (FuSa) Option helps meet up to ISO 26262 ASIL B and D requirements against random hardware faults.