FPGAs no longer live inside closed, single‑purpose systems where the environments are tightly controlled and predictable. They now sit in cloud servers, edge AI devices, automotive platforms, and industrial IoT nodes, in space as well as on Earth. They are updated remotely, exposed to wider networked systems, and are often part of establishing or enforcing a system’s chain of trust.
The attack surface has become bigger, wider and far less predictable.
All of which means FPGA engineers now need a broader and deeper understanding of hardware‑rooted security. The familiar topics like bitstream protection, secure boot, and key management are still essential, but they’re now part of a larger picture that includes remote update integrity, lifecycle security, and following new security standards like the Cyber Resilience Act (CRA).
Secure boot is a good example of this shift. Many of us have been using authenticated configuration for years, where the device verifies the integrity and authenticity of the configuration image before it will execute it. In earlier systems, it largely meant a simple, one‑time check at power‑up. The device loaded an image, performed a basic authenticity test and, if it passed, ran it without any further protection.
Modern secure‑boot implementations now feature a full chain‑of‑trust, adding layered verification, hardware‑anchored roots of trust, and continuous protection mechanisms that persist well beyond initial configuration.
Cryptographic verification of early boot stages is now a baseline expectation, and FPGA engineers need to understand not just how to enable secure boot, but how keys are provisioned, how trust is anchored in hardware, and how that trust is maintained across updates.
It’s the same across the whole FPGA design process, with security now part of areas like access control, secure debug, configuration isolation, and interface hardening. It’s shifted from something we think about at the end of a project to something that has to be maintained throughout a device’s life. With FPGAs updated, reconfigured, and repurposed on an ongoing basis, their security posture has to be preserved continuously.
That in turn makes security a design time and development time responsibility, baked into architecture decisions, build flows, provisioning steps, and deployment processes rather than treated as an optional extra.
A measure of its importance is a session at the FPGA Horizons Conference in London in October. In Practical Security Fundamentals for FPGA Engineers, Matt Holdsworth from Lattice Semiconductor will be talking about what many see as the essential security concepts of trust, privacy, integrity, and availability. Not in a theoretical way, but showing how they connect directly to FPGA development and real world system architecture, and influence system design and device selection.
