IoT Security Foundation brings industry leaders together at CHERITech’26 to confront the commercial, technical and organisational barriers to mainstream adoption of hardware-enabled cybersecurity.
Munich, 12th November 2026
For years, the semiconductor and cybersecurity industries have recognised the potential of CHERI (Capability Hardware Enhanced RISC Instructions) to fundamentally improve the security of computing systems. The technology offers a powerful response to some of the most persistent causes of software vulnerabilities, particularly those associated with memory safety.
But an important question remains: if CHERI is such a compelling technical solution, why isn’t everyone using it?
That was the central challenge addressed by the IoT Security Foundation (IoTSF) at CHERITech’26, held alongside SEMICON Europa and Electronica in Munich.
Bringing together perspectives from semiconductor development, commercial deployment, industry collaboration and government-backed innovation programmes, the Foundation’s panel, “What is missing for CHERI to be widely adopted?”, put the focus firmly on the challenges of moving from technical innovation to mainstream commercial adoption.
The discussion was chaired by Christopher Bennison of the IoT Security Foundation, a founding member of the CHERI Alliance.
The challenge is bigger than the technology
CHERI represents a significant development in cybersecurity. By introducing hardware-enforced capabilities for memory protection and software compartmentalisation, it provides mechanisms that can help prevent entire classes of vulnerabilities rather than relying exclusively on detecting and correcting them after they arise.
Its relevance extends across embedded systems, connected devices, critical infrastructure, industrial applications and increasingly complex computing platforms.
Yet technological superiority has never guaranteed commercial success.
For mainstream organisations, adopting a new computing architecture is not simply a question of whether it offers better security. It involves decisions about cost, performance, compatibility, development tools, software availability, skills, product lifecycles and long-term supplier support.
For manufacturers, the challenge is particularly significant. New technology must fit into established engineering processes, deliver demonstrable value and avoid introducing unacceptable commercial or operational risk.
The issue is therefore not just whether CHERI works, but whether the industry can make it sufficiently accessible, practical and commercially attractive for organisations to adopt it at scale.
From security advantage to business decision
One of the most important challenges facing CHERI is translating its technical security benefits into a convincing business proposition.
The cybersecurity community understands the importance of memory safety. However, purchasing decisions are often made by organisations balancing security improvements against competing priorities, including cost, delivery schedules, product performance and existing investments.
For CHERI to become a mainstream purchasing decision, its value must be understood beyond the security engineering community.
That means demonstrating how hardware-enabled memory safety can contribute to business outcomes: reducing exposure to costly vulnerabilities, improving product resilience, supporting secure-by-design development and potentially reducing the effort associated with vulnerability remediation over a product’s lifetime.
It also means understanding where the strongest initial business cases exist.
Sectors involving connected infrastructure, industrial control, embedded computing and long-lived products may offer particularly compelling opportunities, although the economics and implementation challenges will differ between applications.
The opportunity is substantial, but the value proposition must become more tangible to the people making investment decisions.
Breaking the adoption deadlock
A second challenge is the interdependence of the technology ecosystem.
Semiconductor manufacturers need confidence that customers will adopt CHERI-enabled processors. Software developers need accessible hardware, mature development environments and dependable support. Product manufacturers need confidence in the software ecosystem and supply chain.
Customers, meanwhile, need to see practical solutions rather than isolated technical capabilities.
This creates a familiar problem for emerging technologies: each part of the ecosystem is waiting for another to move first.
Breaking that cycle requires coordinated progress across hardware, operating systems, development tools, applications and commercial deployment.
Open standards, interoperable implementations, accessible development platforms and demonstrable customer use cases all have important roles to play.
No single company or organisation can deliver widespread CHERI adoption independently.
The transition from promising technology to established market requires an ecosystem, not simply a processor.
Real-world deployment must lead the next phase
The importance of practical deployment was another central theme of the session’s agenda.
Technical demonstrations and research achievements provide essential evidence of CHERI’s capabilities, but organisations considering commercial adoption need to understand what implementation means in practice.
What needs to change in an existing software development process? What additional skills are required? How much of an established software stack can be retained? What is the impact on cost, performance and time to market?
And perhaps most importantly, what lessons can be learned from organisations already exploring CHERI in real products and systems?
Programmes such as the UK’s CHERI Secure by Design Managed Deployment Programme are important in helping bridge this gap between research and commercial implementation.
By bringing together technology providers, developers and potential adopters, such initiatives can help identify practical barriers, develop implementation experience and create evidence that supports future investment decisions.
The next phase of CHERI adoption will depend not only on further technical progress, but on making the experience of early adopters accessible to the wider industry.
Regulation, standards and the changing security landscape
The wider cybersecurity landscape is also changing.
Governments, regulators and customers are placing increasing emphasis on secure-by-design principles, software vulnerability management and the resilience of connected products.
In Europe, the Cyber Resilience Act is creating new expectations for the cybersecurity of products with digital elements. Although it does not prescribe CHERI or any particular processor architecture, it reinforces the importance of addressing security systematically throughout the product lifecycle.
At the same time, work on hardware and software standards can help provide the confidence and interoperability needed for broader adoption.
CHERI has an opportunity to contribute to this changing environment by enabling stronger security foundations at the architectural level.
However, it is important that hardware-enabled protection is understood as part of a wider cybersecurity strategy, rather than a replacement for secure software engineering, vulnerability management or established security assurance practices.
The next 12 months: turning ambition into action
The most important question for the industry is perhaps the simplest: what needs to happen next?
Progress towards mainstream CHERI adoption will require practical commitments from across the technology supply chain.
Semiconductor companies can accelerate the availability of deployable hardware platforms. Toolchain and operating-system developers can reduce the complexity of adoption. Product manufacturers can identify commercially relevant use cases and undertake practical evaluations.
Governments and industry bodies can support collaboration, skills development, standards activity and programmes that demonstrate commercial viability.
And customers can play a critical role by making hardware-enabled memory safety part of their conversations with technology suppliers.
None of these actions alone will establish CHERI as a mainstream technology. Together, however, they can help build the market confidence and practical experience necessary for adoption at scale.
From technology leadership to industry transformation
As a founding member of the CHERI Alliance, the IoT Security Foundation is committed to helping move hardware-enabled cybersecurity from technical innovation towards practical deployment.
Its role in convening the CHERITech’26 discussion reflects a broader ambition: connecting the organisations developing advanced security technologies with the businesses, product manufacturers and policymakers responsible for bringing them into everyday use.
The opportunity presented by CHERI is significant. Memory safety remains a fundamental challenge for the technology industry, and improving security at the hardware level offers a potentially powerful way to address it.
But the ultimate measure of CHERI’s success will not be the sophistication of its architecture or the strength of its research foundations.
It will be the extent to which the technology becomes a practical, trusted and commercially viable component of real products and systems.
The industry has spent years demonstrating what CHERI can do. The challenge now is to make it something organisations can confidently choose to use.
About the panel
The IoT Security Foundation’s discussion, “What is missing for CHERI to be widely adopted?”, was chaired by Chris Bennison and announced with contributions from:
– Javier Orensanz Martinez, CEO, lowRISC
– Joshua Cooper, CEO, Hildebrand Technology Limited
– Manu Ravishankar, Principal Consultant, PA Consulting
– Mike Eftimakis, Founding Director, CHERI Alliance
CHERITech’26 took place on 12th–13th November 2026 at Messe München, alongside SEMICON Europa and Electronica.
About the IoT Security Foundation
The IoT Security Foundation is an international industry organisation dedicated to improving the security of connected products and systems. Through industry collaboration, practical guidance, technical initiatives and advocacy, IoTSF works to advance cybersecurity throughout the technology lifecycle.
As a founding member of the CHERI Alliance, the Foundation supports the development and adoption of hardware-enabled security technologies that can help build a more secure and resilient digital future.
Further information: cheri-alliance.org