Years of British research into memory-safe computing are beginning to encounter the more difficult test of commercial adoption, with SCI Semiconductor raising £5 million after fabricating its first chips and securing more than £2 million of customer orders.

The Sheffield-headquartered company is developing ICENI, a family of microcontrollers based on CHERI capability technology that changes how processors control access to memory. SCI announced first silicon earlier this year, taking an architecture developed through academic, government, and industrial research into physical hardware intended for commercial products.

The new investment was led by investors including PXN Ventures and Mercia Ventures, while SCI has separately secured government contracts and research relationships involving large technology companies. The combination of fabricated hardware, customer orders, and external funding gives the company a stronger commercial position than a semiconductor project still confined to research prototypes.

Memory safety vulnerabilities occur when software accesses memory outside the boundaries intended by its developers, allowing information to be read, overwritten, or redirected in ways that can become exploitable. The problem has persisted for decades, particularly in software written in languages where programmers manage memory directly.

One response is to rewrite software in memory-safe languages such as Rust, but the installed base of embedded systems makes wholesale replacement impractical. Industrial controllers, communications equipment, vehicles, medical systems, and other connected devices can run complex code for years, while manufacturers often depend on mature software libraries that cannot be replaced quickly.

CHERI, or Capability Hardware Enhanced RISC Instructions, approaches the problem at processor level by attaching explicit bounds and permissions to memory references. Hardware can then prevent software components from reaching memory they have not been authorised to access, reducing the opportunities available to an attacker who exploits a coding error.

SCI’s ICENI design also uses fine-grained compartmentalisation so that a vulnerability in one part of a system does not automatically provide access to every other component. The technology cannot eliminate all cyber risk, but it can constrain a class of weaknesses that has repeatedly appeared in security advisories across consumer, enterprise, and industrial technology.

Research success does not guarantee adoption

The UK government has invested heavily in CHERI because memory safety offers a route to stronger security that does not depend entirely on finding and patching software defects after products are deployed. Public funding and industrial co-investment have supported research at Cambridge and development involving technology companies, government bodies, and semiconductor specialists.

Turning that intellectual position into a commercial semiconductor ecosystem is considerably harder. Chip buyers do not purchase processor security in isolation; they work within development environments built around compilers, operating systems, libraries, debugging tools, reference boards, certification processes, and engineering experience accumulated over many years.

A technically stronger architecture can therefore struggle if adopting it forces customers to rebuild too much of the surrounding software and tooling. SCI’s commercial argument depends on improving memory protection while allowing organisations to retain and adapt enough existing code for migration to remain practical.

That trade-off is particularly important in embedded systems because product lifecycles can be long and software changes expensive. A manufacturer producing industrial equipment or safety-sensitive devices may support a product for a decade or more, which means architectural decisions made at design stage can shape vulnerability exposure long after the hardware ships.

European product-security regulation strengthens the incentive to reduce those risks earlier. The Cyber Resilience Act and related secure-by-design expectations push manufacturers towards more systematic vulnerability management, lifecycle support, and engineering controls rather than treating cybersecurity as an after-sales patching exercise.

Hardware-enforced memory safety fits that direction, although it does not make a product secure on its own. Stolen credentials, flawed business logic, compromised suppliers, insecure update mechanisms, weak cryptography, and vulnerabilities unrelated to memory management remain available to attackers even when the processor prevents some classes of memory misuse.

The narrower claim is also the more commercially credible one. If a processor can prevent or contain a large category of vulnerabilities without imposing unacceptable cost, performance penalties, or developer friction, manufacturers gain a security control that operates beneath the application software.

Production economics will eventually matter as much as architecture. Semiconductor businesses require reliable fabrication, packaging, testing, distribution, and support, while customers need confidence that components will remain available throughout the lifetime of the systems into which they are designed.

SCI designs its technology in the UK while fabrication takes place elsewhere in Europe, reflecting the distributed character of the semiconductor supply chain. European sovereignty in this market rarely means every stage happens inside one country; more often it means retaining strategically valuable intellectual property and design capability while working through international manufacturing networks.

The company’s reported order book remains small beside mainstream semiconductor volumes, but orders provide more useful evidence than research demonstrations because customers are beginning to commit money to physical devices. The next test will be whether those early projects become repeat deployments and whether engineers outside the CHERI research ecosystem can adopt the architecture without excessive friction.

After years in which CHERI was discussed mainly through research papers, government programmes, and processor specifications, fabricated ICENI devices are now moving into customer hands. The funding gives SCI more capacity to scale that effort, but the more important question is whether memory-safe hardware can become an ordinary engineering choice rather than remaining an unusually successful security research programme.