Marvell, Microsoft and Oracle are trying to move one of the cloud’s most sensitive control points out of the network and into the server itself. On Oct. 13, 2026, the companies said they had formed a new Open Compute Project working group under OCP’s Security Track to define an open specification for a silicon-based, attested integrated hardware security module for cloud and hyperscale infrastructure.
That matters because key custody, attestation and cryptographic policy are becoming infrastructure bottlenecks as AI fleets grow. The practical question for buyers is whether an open, server-local HSM can become a genuinely portable standard for cloud security, or whether it will harden into another vendor-shaped hardware dependency before the draft, certification and operating details are settled.
The early answer is encouraging but incomplete: the architecture addresses a real problem, and the choice to take it into OCP raises the odds of broader industry input. But what exists today is a workstream, not a finished standard, certified silicon design or widely available service.
The control plane moves into the server
In Marvell’s announcement, the founding companies described a design aimed at NIST FIPS 140-3 Level 3 integrated HSM capabilities. Their argument is straightforward. Many cloud and enterprise servers still depend on network-attached HSMs or software-only key management, which can mean keys traverse the network for cryptographic operations or sit in memory outside a Level 3-certified boundary.
The proposed design pulls those functions closer to the workload. The companies say the integrated HSM architecture is meant to support secure key caching, cryptographic key-lifecycle management, a hardware security boundary and an attestation chain directly in the server. In practical terms, that could let encryption, signing and related operations happen where the workload runs, while keeping keys inside a hardware boundary and giving relying parties a way to verify workload integrity cryptographically.
That is why the announcement matters beyond routine standards politics. For large cloud operators and AI data centers, the cost of weak key handling is not just theoretical compromise; it is latency, network overhead, operational complexity and compliance friction at fleet scale. The more often a platform has to reach across the network for protected key operations, the harder it becomes to scale confidential workloads cleanly.
Microsoft’s related Project Tessera makes the ambition clearer. The company describes Tessera as an open-source evolution of Azure Integrated HSM, including architecture, specifications, protocols, drivers, software, firmware and reproducible build environments for broader community use. That pushes the effort beyond a narrow chip feature and toward a full hardware-software control plane.
What “open” could change — and what it cannot
Putting the work under OCP matters because the companies say they intend to publish an open technical specification rather than a proprietary product spec, with an initial draft targeted around the 2026 OCP Global Summit in San Jose and version 1.0 to follow. If that process attracts server vendors, silicon suppliers, cloud operators and security buyers beyond the founding trio, it could turn server-local key protection from a house design into an industry reference point.
That would be a meaningful shift. Today, cloud customers often have limited leverage over how deeply security controls are tied to a provider’s internal architecture. A widely adopted open specification could give buyers a stronger basis for comparing key custody, attestation and workload-verification features across clouds and hardware platforms. It could also create a new area of competition for server and accelerator vendors: not just raw performance, but attestable security primitives that fit into AI infrastructure as a normal design requirement.
Still, “open” does not automatically mean interchangeable. An OCP specification can improve reviewability and interoperability without making every implementation equivalent. The trust boundary in this model moves deeper into server silicon, firmware, manufacturing and supply-chain processes. That may reduce network hops, but it also means buyers have to care more about update mechanisms, hardware replacement, revocation and who controls the roots of trust.
This is also where established alternatives keep their appeal. Network-attached HSMs and cloud KMS products have operational advantages that direct-attached hardware does not erase, especially centralized administration and replacement flexibility. Software-based controls remain useful in layers where hardware integration is impractical or unnecessary. The likely future is additive: a server-local HSM could become an important new layer, not a universal substitute for remote HSMs, cloud KMS or confidential-computing roots of trust.
The buyer questions the announcement does not answer yet
The public material leaves out the issues procurement and risk teams will eventually have to sign off on. The companies have not published the draft specification, API details, licensing terms, production timeline, silicon implementation or independent performance data. They have not shown measured latency under load, throughput tradeoffs, fault behavior or the cost comparison between direct-attached HSMs, network HSMs and software key management at hyperscale.
Certification is the most obvious gap. Marvell’s announcement describes FIPS 140-3 Level 3 as a target and design objective, not a completed validation. That distinction matters. Buyers in regulated sectors should want evidence of independent certification, not just architectural intent, before treating this as a procurement signal.
The harder operating questions are equally important. It is not yet clear how the OCP workstream or Tessera will handle tenant separation, key import and export, backup and recovery, certificate rotation, multi-cloud portability, firmware updates, attestation verification, hardware replacement or revocation after compromise. Post-quantum readiness is part of the strategic backdrop for the announcement, but the releases do not spell out a migration path from classical to post-quantum algorithms.
Those gaps shape the real adoption test. If the group can publish a credible threat model, stable interfaces, auditable firmware practices, reproducible builds and clear recovery semantics, the effort could become one of the more consequential infrastructure-security standards projects now underway. If not, Tessera may end up serving mainly as a transparent reference implementation for the founding vendors, strengthening their influence over the security stack without delivering much portability.
For now, the news is not that cloud key security has been solved. It is that three major infrastructure players have agreed on where the next fight will happen: inside the server. Watch the draft, who else joins the OCP group, and whether the first real artifacts answer the buyer questions that the launch announcement leaves open.
By
By
By
By
By
