CHERI adoption and diffusion research

Background

Capability Hardware Enhanced RISC Instructions (CHERI) is a UK-developed hardware innovation designed to embed security at the architectural level. By introducing memory-safe pointer architecture and secure compartmentalisation, CHERI aims to significantly enhance system security. The technology has been developed with support from the UK government’s Digital Security by Design (DSbD) programme, which funded the creation of a hardware platform prototype and supported the development of software tools and an ecosystem of academic researchers and SMEs.

To inform future policy and investment decisions, the Department for Science, Innovation and Technology (DSIT) commissioned Fortia Insight (previously RSM UK Consulting LLP) to assess the potential market for CHERI, identify key adoption sectors and explore how government could facilitate its diffusion across the semiconductor landscape.

In terms of methodology, Fortia Insight adopted a mixed-methods approach, including desk research, literature reviews and stakeholder engagement. A combination top-down and bottom-up approach was used for market analysis.

• The top-down component involved mapping the CHERI market using published data, expert consultations and economic statistics to estimate its scale and composition.
• The bottom-up component focused on identifying individual firms within relevant market segments and conducting primary research through surveys and interviews.

This dual approach enabled Fortia Insight to balance statistical breadth with firm-level insight, mitigating the limitations of any single method and enhancing the reliability of the findings.

Sector readiness

• IoT and embedded systems: these represented the most immediate opportunity for adoption due to lower design costs and fewer legacy constraints.
• Telecoms infrastructure and defence: these sectors showed strong interest, though adoption was likely to be slower due to capital intensity and long procurement cycles.
• Automotive: this sector demonstrated growing engagement, though complex supply chains and regulatory environments posed challenges.
• Mobile devices: this sector was considered the least likely to adopt CHERI in the near term, due to high processor optimisation requirements and the scale of redevelopment work necessary on established software ecosystems.
• Awareness ecosystem: the DSbD programme had successfully cultivated a core ecosystem of 136 companies and approximately 875 individuals actively engaging with CHERI in the UK.
• International reach: awareness of CHERI was also growing internationally, particularly in the US, Europe and Japan, supported by early Defense Advanced Research Projects Agency (DARPA) funding and UKRI-led outreach.

Fortia Insight’s evaluation provided DSIT with a strategic evidence base that informed several key areas.

• Further support: the research has been used to inform DSIT’s decision to commission a managed deployment programme for CHERI in Critical National Infrastructure, and two innovation competitions with £22 million funding to develop CHERI tools and software and CHERI RISC-V devices.
• Targeted engagement: the study highlighted the need to engage senior decision-makers with economic and return on investment focused messaging, rather than purely technical arguments.
• Investment strategy: recommendations guided future funding priorities, including support for software development tools, skills development and microprocessor innovation.
• Sectoral use cases: the report demonstrated CHERI’s value proposition in telecoms, IoT, automotive and defence through case studies and sector-specific insights.