The European Union’s Cyber Resilience Act (CRA), which becomes mandatory in December 2027, is raising the bar for cybersecurity in connected devices. Rather than relying on software patches to address vulnerabilities after they emerge, manufacturers are under growing pressure to build security into products from the outset. For connected devices , that shift puts flash memory in a new role: alongside storing code and data, it must help protect device identity, data integrity and software updates. Donald Huang, director of product marketing and cybersecurity manager at Macronix International, said software updates alone cannot adequately address threats such as physical attacks and the interception or manipulation of communications. The CRA’s Security by Design principle calls for protection to be built into products from the earliest stages of development, extending a hardware root of trust (ROT) beyond the processor and into storage components. Donald Huang, director of product marketing and cybersecurity manager, Macronix International Why Security Must Extend Beyond Software Securely Update Millions of DevicesThe CRA sets requirements for secure product design, protection of critical assets, and identity and supply-chain authentication. Manufacturers must ensure that components are trustworthy and that keys, code and data are protected from the beginning of the design process. Products must also be built to withstand cyberattacks at the system level. These requirements are putting the hardware ROT, which combines physical protection with cryptographic authentication, in the spotlight. As Huang explained, attackers have several ways to get around software-based defenses. They can manipulate voltage, temperature or clock signals to launch physical attacks, tap the bus between flash memory and the host to intercept data, or replay previously valid commands. Security measures confined to software leave potential entry points in the hardware and communication interfaces. Macronix developed its ArmorFlash family to address these threats by building security functions directly into NOR flash. Huang noted that the company introduced its security memory portfolio in 2019, embedding security into the storage architecture instead of relying on a separate security chip alongside conventional flash. A conventional design pairs standard NOR flash with a separate secure element (SE), requiring additional hardware and an interface between the SE and the system-on-chip (SoC). ArmorFlash takes a different approach, integrating a secure engine, authentication functions and security protocols into the flash device itself. It connects to the host through a standard Serial Peripheral Interface (SPI) and provides both general-purpose storage and a configurable secure area. The integrated approach can also ease the addition of security to existing products. Because redesigning an established system’s SoC and circuitry can be costly and disruptive, ArmorFlash uses a standard SPI interface and pin-compatible design to add hardware security without extensive circuit changes. This can reduce both the hardware cost and the design complexity associated with a separate secure element. Compared with a conventional design that relies on a separate secure element, ArmorFlash combines security functions with a standard SPI interface and enables seamless access to secure areas. The integration is designed to improve performance and protection while simplifying upgrades to existing systems. (Source: Macronix) ArmorFlash Combines Secure Boot, PUF and Data Protection Macronix offers several products to address different security needs. For instance, ArmorBoot (MX76) supports secure boot, while ArmorFlash (MX75/MX78) provides data security. The ArmorFlash portfolio covers device authentication, secure boot and data protection, offering secure-memory solutions for a range of applications. (Source: Macronix) The ArmorBoot MX76 verifies the integrity of boot code st