Embedded devices deployed in the field can remain in service for years, making secure boot, dependable device identity and protection of cryptographic keys persistent security concerns. If a device cannot establish trusted software at startup or safeguard the credentials it uses, manufacturers have a weaker foundation for managing exposure over a long support life. Those controls are also becoming more consequential as product-security rules require manufacturers to respond to serious vulnerabilities and sustain security updates.
Variscite and SecEdge have added firmware-based TPM 2.0 capabilities across Variscite’s i.MX system-on-module portfolio. The companies said the integration gives OEMs and system integrators a way to add hardware-anchored Trusted Platform Module functions through the processor already used in a design, rather than adding a discrete security chip or redesigning the board.
TPM 2.0 defines a protected environment for secure boot, device identity and the storage and use of cryptographic keys. Those functions are particularly relevant to edge products that may be distributed across customer sites and maintained over a multiyear lifecycle. A discrete TPM is one implementation option; the new offering uses SecEdge’s SEC-TPM firmware TPM implementation instead.
According to the companies, SEC-TPM runs in the OP-TEE secure world through Arm TrustZone and is compliant with the Trusted Computing Group’s TPM 2.0 standard. On i.MX 93 and i.MX 95 modules, the software can use the processor security architecture, including the EdgeLock Secure Enclave, as a root of trust. The companies said the firmware TPM is now integrated and documented for Variscite’s i.MX 6, 7, 8 and 9 module families and is available through its Developer Center.
The timing is tied in part to the European Union’s Cyber Resilience Act. The reporting requirements for actively exploited vulnerabilities and severe incidents took effect on Sept. 11, 2026, according to the companies. The broader requirements apply from Dec. 11, 2027 and include secure default configurations, the absence of known exploitable vulnerabilities at shipment, security updates during a support period that defaults to five years, and conformity assessment before CE marking.
The partners are positioning firmware TPM 2.0 as a component of that compliance work rather than as a complete compliance solution. The technology can help a device prove its identity and protect its keys, but manufacturers would still need to address product configuration, vulnerability handling, software maintenance and the other obligations of the Act.
For existing installations, the companies said SEC-TPM can be added to previously developed or deployed systems that support secure firmware updates. That could give product teams a route to implement TPM functions without a board respin. Variscite also said it maintains board-support-package branches with security updates and documents secure boot and TPM integration; it targets product longevity of seven to 15 years for its modules.
The practical benefit is architectural continuity for device makers that already use the company’s modules. A team can use the same TPM approach for a current deployed system and, within Variscite’s pin-compatible product families, when moving to a higher-performance module. That does not eliminate validation, update-management or compliance work, but it may reduce a hardware change that would otherwise add engineering time and risk.