TL;DR: A CHF 40-60 million centre could build Swiss capabilities for post-quantum semiconductor personalization, cryptographic root-of-trust injection and secure provisioning, with up to 250 direct jobs over eight years, according to WISeKey. The governance issue is not the project alone but the shift toward hardware-rooted trust, which changes how identity, device authenticity and provisioning controls must be managed across IoT and critical systems.
At a glance
What this is: WISeKey’s proposed Jura center would combine post-quantum semiconductor personalization with cryptographic root-of-trust capabilities, signalling a shift toward hardware-rooted trust for digital identity and IoT.
Why it matters: It matters because IAM, NHI and device governance teams will need to align identity assurance, provisioning and certificate controls with hardware-backed trust rather than assuming software-only control planes can carry the load.
Context
Post-quantum hardware changes the trust anchor, not just the algorithm. In semiconductor and IoT environments, the key governance problem is no longer only whether a credential is strong enough, but whether the device and its cryptographic root can be trusted from fabrication through provisioning and ongoing use. That matters directly for digital identity, NHI, and machine trust models.
This announcement is best read as an industrial and governance move rather than a product release. The proposed center points to a future where sovereign provisioning, certification, and root-of-trust management sit closer to hardware production, which raises the bar for lifecycle control across certificates, firmware, and device identity.
For practitioners, that is a familiar pattern in a new form: when trust roots move into hardware, the surrounding identity controls must become more explicit, auditable, and lifecycle-aware. That is typical of mature security programmes, but still atypical in many IoT and embedded estates.
Key questions
Q: What fails when hardware-rooted device trust is not governed as part of IAM?
A: When hardware trust is outside IAM governance, organisations lose visibility into who can bind identity to a device and how that identity can later be revoked. The result is durable trust in devices that may no longer be authentic, especially when provisioning, firmware signing and certificate management are split across teams.
Q: Why does post-quantum migration increase the importance of device lifecycle controls?
A: Post-quantum migration shortens the useful life of older cryptographic assumptions and forces organisations to revisit key rotation, reissuance and attestation at scale. Without lifecycle control, embedded devices can retain identities that are cryptographically outdated but still operationally accepted.
Q: How should security teams govern secure provisioning for embedded identities?
A: Security teams should govern provisioning as an identity event, with approved issuers, recorded trust roots, recertification points and clear offboarding paths. That approach keeps device identity, certificate handling and hardware provenance aligned instead of treating manufacturing as outside security scope.
Q: How do hardware trust anchors change the way organisations think about machine identity risk?
A: Hardware trust anchors move risk from the software boundary into the supply chain and production line. That means machine identity risk is shaped by personalization quality, traceability and revocation capability, not only by password or certificate strength.
Technical breakdown
Cryptographic root of trust in semiconductors
A cryptographic root of trust is the hardware-held starting point that anchors later device identity, attestation, and secure boot decisions. If that root is injected or personalised during semiconductor provisioning, the assurance boundary shifts from the application layer to the chip supply chain. Post-quantum algorithms such as ML-KEM and ML-DSA matter here because they are intended to preserve trust even as classical public-key methods weaken. The security question is not only algorithm choice, but whether the chip, firmware and certificate chain all align to the same provenance model.
Practical implication: align device identity and certificate issuance to the hardware provisioning process, not to later software configuration.
Secure provisioning and firmware personalisation
Secure provisioning is the controlled process of binding keys, identities, firmware and policy to a device before it enters production use. In this model, personalization is not cosmetic. It is where identity, entitlement and trust attributes are loaded into the semiconductor so downstream systems can distinguish genuine hardware from cloned or altered devices. For NHI governance, that creates a tighter relationship between manufacturing controls, certificate lifecycle, and offboarding. If provisioning is weak, the device may look legitimate long after the original trust assumption has failed.
Practical implication: treat provisioning as an identity event with audit evidence, ownership, and revocation requirements.
Post-quantum security and machine identity governance
Post-quantum security changes the cryptographic shelf life of identities that depend on long-lived keys, certificates and signed firmware. The issue for machine identity is not just migration to a new algorithm set. It is whether the organisation can re-issue, rotate, and verify trust materials across embedded fleets without breaking operational continuity. That brings NHI lifecycle management into the same conversation as PKI and hardware supply chain assurance. Where those functions are separated, post-quantum readiness becomes fragmented and slow.
Practical implication: map embedded device identities to their full lifecycle now, including rekeying, recertification and retirement.
Threat narrative
Attacker objective: The objective is to subvert the device trust chain so counterfeit or tampered hardware is accepted as legitimate.
- Entry begins at semiconductor design and personalization, where the trust anchor is embedded into hardware before deployment.
- Credential access occurs if provisioning, firmware signing, or root-of-trust material is mishandled, because downstream systems inherit that trust automatically.
- Impact is compromise of device authenticity and long-term trust in connected systems, especially where embedded identities support secure communications or critical infrastructure.
Breaches seen in the wild
- Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Hardware-rooted trust is becoming an identity governance problem, not just a semiconductor design problem. Once the root of trust sits inside the chip, identity assurance depends on fabrication, personalization, and provisioning controls working as one. That changes the governance boundary for IoT, embedded systems, and machine identities. Practitioners should treat hardware trust as part of the identity stack, not as a separate engineering detail.
Post-quantum migration will expose lifecycle weaknesses that older PKI models could defer. Long-lived devices, certificates, and firmware signatures become harder to manage when cryptographic agility is missing. The project signals that post-quantum readiness is really an inventory, rotation, and attestation problem wrapped inside a cryptography problem. The practical conclusion is that machine identity governance must be recast for rekeying and recertification at scale.
Secure provisioning is the named control gap this announcement puts in focus. The critical assumption is that once a device is personalised, its identity remains trustworthy for the rest of its life. That assumption fails if provisioning, offboarding, or supply chain evidence is incomplete. The practitioner takeaway is to verify who can inject trust, when that trust is bound, and how it will be revoked.
Swiss sovereignty is an operational assurance story as much as an industrial policy story. Localising personalization, testing, and certification can improve accountability, but only if the governance model preserves traceability across suppliers and partners. For identity teams, the signal is clear: sovereignty claims are only useful when they map to auditable lifecycle control. Practitioners should demand that same traceability from their own embedded and NHI estates.
Root-of-trust injection creates a new control plane for machine identity. That control plane must connect PKI, device attestation, firmware provenance, and retirement processes. Otherwise, the organisation ends up with strong chips but weak identity governance. The field should expect more convergence between semiconductor security and NHI lifecycle management.
What this signals
Root-of-trust injection is becoming the decisive control point for machine identity programmes. Once trust is embedded in hardware, the control problem moves upstream into manufacturing, certification and supplier governance. Practitioners should ensure their identity roadmap covers the full path from chip personalisation to runtime attestation.
Post-quantum readiness is really lifecycle readiness in disguise. The organisations that cope best will be the ones that can reissue, recertify and retire device trust material without disrupting operations. That is especially relevant for fleets where certificates, firmware and device identity change at different speeds.
Hardware sovereignty will only matter if it produces auditable provenance. Local manufacturing, local personalization and local testing do not by themselves deliver trust unless each step leaves evidence that can be reviewed later. Identity and security teams should insist on the same traceability for embedded devices that they expect from privileged access and NHI controls.
For practitioners
- Map hardware trust into identity governance Inventory where device identity, certificate issuance and secure boot are anchored in hardware rather than software so ownership is explicit.
- Require provenance for root-of-trust injection Document who can inject keys or trust material during semiconductor personalization, and retain evidence for later audit and recertification.
- Tie provisioning to offboarding and rekeying Treat embedded device provisioning as a lifecycle event with rekeying, revocation and retirement steps, not a one-time factory action.
- Update NHI and PKI inventories together Keep certificates, firmware signing keys and device identities in the same inventory so quantum migration does not split control across teams.
- Test traceability across partners and fabs Verify that supplier, manufacturing and certification records can be traced end to end when trust roots are embedded at chip level.
Key takeaways
- The article shows that post-quantum semiconductor work is really about where trust starts, how it is bound to devices, and who can later revoke it.
- The scale signal is a proposed CHF 40-60 million centre with more than 250 direct jobs over eight years, which suggests long-term industrial commitment rather than a short pilot.
- The practical implication is that IAM, PKI and NHI governance must extend into hardware provisioning, provenance and lifecycle control if device trust is to remain auditable.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | Hardware-bound identities need tightly governed issuance and scope, or trust becomes too broad. |
| NHI-07 — Long-Lived Secrets | Post-quantum migration stresses long-lived keys, certificates and firmware trust material. | |
| Recommendation — Limit device trust scope and bind provisioning rights to the smallest necessary set of operators. Plan for rekeying and certificate rotation before embedded trust material reaches end of life. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Authenticator lifecycle control directly applies to keys and certificates used by embedded devices. |
| Recommendation — Apply IA-5 to govern issuance, storage, rotation and revocation of machine authenticators. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Device provisioning and personalization determine which identities and entitlements the hardware can assert. |
| Recommendation — Use PR.AA-05 to keep device entitlements aligned with approved provisioning and offboarding records. | ||
| MITRE ATT&CK | TA0006; TA0008 — Credential Access; Lateral Movement | Compromised root-of-trust material would enable credential abuse and movement across trusted systems. |
| Recommendation — Map exposed provisioning paths to TA0006 and TA0008 so hardware trust abuse is detectable. | ||
Key terms
- Root Of Trust: A root of trust is the authoritative starting point that other identities and certificates rely on for validation. In distributed ecosystems, it determines which parties can establish trust, which can be revoked, and how consistent authentication remains across vendors and environments.
- Secure Provisioning: Secure provisioning is the controlled process of assigning identity, keys and policy to a device or workload before it enters service. It is a lifecycle control that must be auditable, because errors at this stage often persist for the full operational life of the asset.
- Cryptographic agility: The ability to change cryptographic algorithms, key lengths, or trust models without reworking every application. For machine identities, it reduces the risk that long-lived services will fail when standards shift or when post-quantum migration becomes necessary.
- Machine identity lifecycle: Machine identity lifecycle is the full governance process for a non-human identity from creation to retirement. It includes provisioning, access scoping, rotation, renewal, offboarding, and auditability, and it fails when any one of those steps is handled manually or inconsistently.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners connect identity lifecycle control to the broader security programme they run.
Published by the NHIMG editorial team on September 22, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org