ProvenRun is making a case for embedded security that starts below the application layer, with a mathematically verified trusted base rather than another add-on middleware stack. In this interview, the company explains how ProvenCore, its formally proven secure OS and TEE, is used to build high-assurance systems for automotive, avionics, defense, microcontrollers and cloud security, with the goal of reducing attack surface, simplifying certification and keeping long lifecycle products maintainable. https://provenrun.com/
A big part of the discussion is the shift to software-defined vehicles and zonal automotive Ethernet. ProvenRun’s protocol-break approach fully deconstructs and reconstructs traffic between exposed domains and safety-critical zones, rather than relying only on segmentation. That matters for in-vehicle infotainment, connectivity modems and ADAS paths, where 1GbE and faster links now carry far more critical traffic than older in-car networks ever did.
The technical differentiator is formal methods. ProvenRun says ProvenCore remains the only operating system certified at Common Criteria EAL7, and that foundation is then reused for trusted applications such as secure storage, cryptography, PKCS#11, VPN, network stacks, secure firmware update and protocol filtering. The company also highlights compatibility with standard embedded security ecosystems including GlobalPlatform, PSA-style APIs, Android trusted applications and post-quantum cryptography work with CryptoNext.
The interview also touches the microcontroller side, where ProvenCore-M is positioned as a secure RTOS and TEE for Arm v8-M class devices, including ST deployments around STM32 security architectures. That gives developers a pre-certified route to TrustZone-based isolation, secure services and easier product evaluation without having to design every security primitive from scratch. Filmed at Embedded World 2026 in Nuremberg, the demo shows how that same security-by-design philosophy is now being stretched from MCU roots into automotive gateways and trusted edge compute.
On the cloud side, ProvenRun is pushing ProvenHSM and ProvenBox as remotely manageable hardware-backed trust anchors for key management, crypto services and customizable secure applications. The interesting angle is not just HSM throughput, but compositional certification, cloud-native administration, FPGA-assisted crypto acceleration and a roadmap that includes PQC readiness. Overall, this is a useful look at how embedded cybersecurity is moving toward verifiable isolation, certifiable trusted execution and longer-term lifecycle assurance across both edge and data center scale.
All my Embedded World videos are in this playlist: https://www.youtube.com/playlist?list=PL7xXqJFxvYvjgUpdNMBkGzEWU6YVxR8Ga



