SECAI Core · phase 10 of 15
Hardware security module
An appliance for generating and storing cryptographic keys. This sort of solution may be less susceptible to tampering and insider threats than software-based storage.
The Explain card
- Plain English
- An HSM is a dedicated, tamper-resistant device that generates, stores, and uses cryptographic keys. Keys never leave the hardware; applications ask the HSM to sign or decrypt on their behalf.
- Example
- A model vendor signs released model weights with a private key held in an HSM. Even a compromised build server cannot export the key to forge a signature on a backdoored model file.
- Why it matters
- Software key storage is one memory dump or one rogue admin away from theft. HSMs give AI pipelines a hardened anchor for signing artifacts, encrypting datasets, and protecting API secrets.
- Hook
- A vault that does the math inside, so the key never steps outside.
Where it sits in the deck
Phase 10: Identity, Access, and Cryptographic Foundations
Before examining threats to systems, establish the foundational security primitives — identity, authentication, authorisation, and the cryptography underpinning them.
