For years the security conversation in data centers has been about software: what runs on the servers, who can reach it, and how quickly a flaw is patched. The hardware underneath was treated as the foundation that could be trusted by definition.
That assumption is being tested as AI clusters grow. Marvell, Microsoft and Oracle formed a hardware security working group on October 14 under the Open Compute Project, the industry consortium that publishes open designs for data center equipment. The group’s stated purpose is to establish a common security baseline at the hardware layer, so that components from different suppliers can be evaluated against the same set of expectations.
The gap it addresses is not new. Processors, network interface cards, storage controllers and management chips each carry firmware, each authenticate to the systems around them, and each is designed by a different company with its own security posture. A cluster assembled from such parts has no single definition of what a trusted component is. The working group would try to write one.
What changed is scale and consequence. A modern training cluster contains tens of thousands of accelerators connected by switches and cables, all of it administered by management hardware that has privileged access to everything it controls.
A flaw in that layer does not affect one machine. It affects the fleet. Compromise at the firmware level can survive an operating system reinstall and remain invisible to the software tools that most operators rely on.
Analysts said the formation of the group reflects a shift in how the industry thinks about where attacks begin. Software has been hardened for two decades, with layered defenses, mandatory signing and rapid patching. Hardware and firmware have improved more slowly, in part because responsibility is divided among chip vendors, system builders, operators and standards bodies. No single company owns the problem, which is a reason it has been addressed unevenly.
The three founding companies bring different positions to the effort. Marvell designs the networking silicon, storage controllers and custom accelerators that move data inside a cluster. Microsoft operates one of the largest clouds and buys hardware at a scale that gives its requirements commercial weight.
Oracle builds and runs cloud infrastructure as well and, like Microsoft, carries the cost of any compromise in the systems it sells. A silicon vendor and two large buyers is a combination with the authority to define requirements and the incentive to see them met.
The Open Compute Project is a natural venue. It was founded to share designs for servers and racks that any member could build, and it has since published work on accelerators, switches and cooling. Hardware security specifications fit its model, because a baseline that only one vendor adopts is not a baseline. The consortium’s weakness is the same as its strength: adoption is voluntary, and a specification no one builds to has no effect.
Analysts said the harder problem is verification. Writing a security baseline is a document exercise; proving that a component meets it requires tests, tools and a willingness to fail a supplier. The working group has not said how compliance would be measured, whether it would certify parts, or what it would do about components that fall short. Those choices determine whether the group produces a standard or a statement of intent.
The timing is connected to the build-out. Operators are adding capacity faster than they are adding the staff to secure it, and the equipment they install comes from a supply chain that has grown longer as demand has risen. A hardware flaw found in the field is expensive to fix at any scale, and at the scale now being deployed it is a risk that no single operator can manage alone. Analysts said that shared cost is what makes a common baseline attractive even to companies that would rather set their own.
Where the group’s work would apply first is unclear. Management controllers and network components are the most obvious starting points, because they hold privileged positions and are supplied by a small number of vendors. Memory, storage and power delivery are candidates as well, though the parties responsible for them are more numerous. The working group has not published a scope document.
Attestation is the mechanism the industry has converged on for describing trust in hardware. A component measures its own firmware, signs the result with a key burned into the silicon, and presents that signature to the system that boots it, so an operator can check that what started is what was installed.
The approach has limits. It proves what a component is running, not that the code is free of flaws, and it assumes the signing key has not been compromised. A baseline specification would still have to decide which of those guarantees a component must provide.
Cost is the counterargument. Hardware that authenticates itself needs additional silicon, additional manufacturing steps and additional testing, and each addition raises the price of a component that will be bought by the tens of thousands. Analysts said the reach of the group’s work will depend on how much of that cost buyers are willing to accept, since a baseline that adds expense without a corresponding requirement will be adopted only where a customer insists on it.
For the Open Compute Project, the group is an addition to a portfolio of efforts that already covers power, cooling and rack design. For the three companies, it is an acknowledgment that the trust they place in their own hardware should be something they can describe and test rather than assume. For the industry, the question is the one that follows every voluntary specification: whether buying decisions will be made against it, and by whom.
