ARM unveils Platform Security Architecture, a common industry framework for enhancing the security of IoT devices built on ARM Cortex processors
Arm hopes the adoption of its new PSA system will help protect trillions of connected devices in the future.
Context & Ripple Effects
PSA is Arm's answer to a problem it had already started attacking at the silicon level: the Cortex-R52 safety-critical design showed Arm building isolation into processors for cars and healthcare, and PSA extends that thinking from individual chips to a common framework any Cortex-based device maker can follow.
The move also positions Arm against a rival model that arrived within months — Microsoft's Azure Sphere stack, which bundles an OS, custom microcontroller silicon, and a cloud service — making 2017-2018 the moment IoT security split between open frameworks and vertically integrated stacks.
First-order effects
- Device makers building on ARM Cortex processors get a shared security blueprint instead of designing protections per product, lowering the engineering bar for shipping connected hardware.
- Microsoft's Azure Sphere now competes against an open industry framework rather than filling a vacuum, forcing the comparison onto openness versus integrated control.
Second-order effects
- Arm followed through at the chip level with the anti-tamper-equipped Cortex-M35P and then paired with fellow SoftBank-backed firm Cybereason to cover home devices like lightbulbs and thermostats, turning PSA from paper framework into silicon-plus-software offering.
- Security certification against a common architecture shifts procurement: buyers of connected-device components can demand PSA conformance, pressuring chip vendors downstream of Arm to adopt rather than differentiate on weaker baselines.
Third-order effects
- If the pattern holds, security stops being a bolt-on feature and becomes part of the architecture itself — culminating in Armv9's built-in security features as Arm projects hundreds of billions of its chips shipping over the following decade.
- A de facto Arm-defined security standard for IoT concentrates influence over who can credibly claim a device is secure, raising the prospect that regulators and insurers eventually lean on such frameworks rather than drafting their own.
The trend: IoT security is migrating from per-device afterthoughts into processor architectures and industry-wide frameworks, with Arm setting the default that rivals like Microsoft must answer.