UK invests GBP £21 million to embed CHERI hardware security in tech
The UK government has allocated GBP £21 million to advance hardware-based cybersecurity technology that is designed to counter up to 70% of common cyberattacks. The funding is being channelled through Innovate UK and the Department for Science, Innovation and Technology, targeting integration of the CHERI security architecture into everyday computing devices and national infrastructure.
CHERI approach
CHERI is a hardware-level security technology aimed at mitigating vulnerabilities caused by common software bugs. By embedding security features directly into processors, devices can prevent attacks such as software hijacking and data theft at an early stage. The plan is for CHERI technology to be adopted across a wide range of sectors, including energy, transport, healthcare, and advanced manufacturing.
A portion of the funding, almost GBP £15 million, is being distributed via the Advancing CHERI RISC-V Devices competition to three companies: EnSilica, SCI Semiconductor, and LowRISC. These companies are set to embed the CHERI architecture within commercial products. An additional GBP £6.1 million is dedicated to five projects focused on the tools and software needed to speed up adoption among developers.
Industry participants
The winning companies and university-led projects cover both hardware development and software ecosystems. EnSilica is creating a production-ready microcontroller intended for secure networking in vehicles and industrial automation. SCI Semiconductor is building a processor designed to incorporate post-quantum cryptography and on-device AI, aimed at safeguarding critical infrastructure. LowRISC is progressing the commercial readiness of a CHERI-enabled, Linux-capable processor core for high-security platforms, such as those needed in OpenTitan projects.
Projects funded under the software and tools segment include SCI Semiconductor's developer toolkit with support for C/C++ and Rust, the University of Manchester's specialised operating system for embedded devices, Capabilities Limited's integration work for the FreeBSD operating system, University of Birmingham's memory-safe capabilities for the Zephyr RTOS, and Sensor IT's secure gateway solution for industrial control protocols.
Government strategy
The investment comes as the UK seeks to implement more robust cybersecurity measures for essential infrastructure. New cybersecurity laws are under consideration to guard the critical digital backbone of the economy.
"CHERI changes the game for cyber security, enabling us to build defences directly into device hardware. It can shut down up to 70% of the most common cyber attacks at source, helping protect everything from the smart devices in our homes to the systems that keep hospitals running and transport moving. This is how we are making systems stronger from the ground up, and these investments will help us build a safer digital future as we drive new growth across our tech sector," said Cyber Security Minister Lloyd.
Industry perspectives
Executives from participating organisations highlighted both security and market potential.
"As a leading silicon chip maker, we are delighted to have our secure processor chip chosen by the UK Government for this Contract for Innovation. This will expand our products by offering a CHERI-enabled secure processor chip as a commercial off-the-shelf product, not only putting CHERI-enabled devices into the hands of product developers and strengthening their security capabilities, but also contributing to a more robust and resilient UK technology supply chain," said Ian Lankshear, CEO, EnSilica.
"We are thrilled and honoured to be selected for this critical government contract. This represents a powerful validation of our mission to deliver foundational security for the future of connected systems. By integrating Microsoft's higher-performance, open-sourced, 2nd generation, CHERIoT RISC-V core, we are building on a revolutionary hardware-first approach to memory safety that eliminates the vast majority of today's cyberattacks. Furthermore, we are taking a quantum leap forward in embedded security and intelligence. The inclusion of Post-Quantum Cryptography ensures our microcontroller is resilient against the threats of tomorrow, while the integration of Google's open-sourced Kelvin AI accelerator provides best-in-class, on-device machine learning capabilities. This powerful combination of CHERI's proven security, next-generation cryptography, and advanced edge AI allows us to deliver the most secure and intelligent microcontroller on the market, providing an essential, trustworthy platform for critical infrastructure and industry," said Haydn Povey, CEO of SCI Semiconductor.
Open source collaboration
Technology firms Microsoft and Google are supporting the rollout of CHERI-enabled platforms by supplying open-source processor cores and AI capabilities.
"Microsoft open-sourced the CHERIoT project in 2023 and the higher-performance CHERIoT Kudu RISC-V core in 2025 to enhance security of security processors and embedded ecosystems. We are very happy to see the Digital Security by Design programme funding SCI Semiconductor to adopt this in their next-generation microcontroller products," said Dana Huang, Corporate Vice President, Engineering, Cloud & AI Edge Platform Security at Microsoft.
"The Google open-source Kelvin AI/ML MLIR-compliant core is already in use in many challenging environments, however the ability to integrate it into a CHERI-enabled platform enables a wide array of additionally trustworthy applications to be developed. We are very pleased to be enabling this project and look forward to seeing devices from SCI Semiconductor based on this technology," said Ben Laurie, Principal Engineer, Google Research.
