AI is transforming how organizations build applications, process information and automate decisions. As AI agents become increasingly autonomous, access sensitive data, interact with tools and take actions across enterprise systems, securing the infrastructure that powers them becomes more important than ever.
AI security extends beyond models and applications. It encompasses the compute, networking, storage, firmware and management systems that execute workloads and enforce security controls.
Trusted AI must therefore be anchored in trusted infrastructure. That means moving from assumed trust to verifiable trust: evidence that critical infrastructure is in a known-good state, remains correctly configured and has not drifted because of vulnerabilities, unauthorized modifications, supply-chain compromise or persistent threats.
NVIDIA and cybersecurity partner Eclypsium are advancing infrastructure security for cloud computing and agentic AI
NVIDIA’s built-in platform protections and Eclypsium’s infrastructure provide the trust layer for building and maintaining trust in the infrastructure powering AI. The result is a stronger chain of trust, from verified hardware and firmware to independently enforced AI agent execution.
NVIDIA BlueField DPUs provide a foundation for securing this infrastructure, combining programmable acceleration with hardware-rooted trust, isolation and configurable security boundaries. Every cloud provider builds their infrastructure around DPUs. These capabilities help cloud providers and enterprises build secure, scalable infrastructure tailored to their operational requirements.
A growing cybersecurity ecosystem extends this foundation with additional capabilities. Eclypsium brings expertise in continuous infrastructure security, firmware integrity assessment, configuration analysis and monitoring, helping organizations strengthen visibility and operational assurance across their environments.
Security by Design With NVIDIA BlueField
Modern cloud and AI infrastructure relies on specialized processors that accelerate networking, storage, security and management.
NVIDIA BlueField DPUs combine high-performance networking, programmable computing and in-silicon acceleration to run critical infrastructure services independently of host workloads.
This separation establishes distinct trust domains, allowing infrastructure operators to manage and protect underlying resources independently of the applications and operating systems running on their servers.
BlueField runs NVIDIA Sentry, part of the NVIDIA OpenShell Reference Architecture. This role in protecting autonomous AI agents makes securing the DPU increasingly important. BlueField has dedicated Arm CPU cores, an operating system, firmware and a management controller, and it moves data directly into host and GPU memory as part of its normal function. That privileged position makes BlueField an effective independent control point, and is why the DPU belongs in every operator’s security model, asset inventory and monitoring.
BlueField is engineered with defense in depth, beginning with a hardware root of trust and extending across firmware, operating systems, software and device management.
Its security architecture incorporates authenticated boot, hardware-enforced isolation, protected key management, secure firmware updates, rollback protection and device attestation. These mechanisms work together to protect platform integrity and enforce security boundaries.
Security also extends throughout the product lifecycle. NVIDIA follows rigorous secure development practices, including threat modeling, architecture and code reviews, automated security analysis, vulnerability management, fuzzing and offensive security research.
No complex computing platform is immune to vulnerabilities. That’s why NVIDIA maintains a continuous commitment to security engineering, vulnerability response and software and firmware updates throughout the supported product lifecycle.
Configurable Security for Different Infrastructure Trust Models
No two infrastructure environments have identical security requirements.
A hyperscale cloud supporting multiple tenants operates under different trust assumptions than a single-tenant enterprise AI cluster or an air-gapped AI environment.
These differences influence how administrative privileges, management interfaces, device access and isolation boundaries should be configured.
A defining advantage of DPUs is their combination of in-silicon acceleration and programmable computing. Unlike conventional high-speed network adapters, DPUs provide dedicated compute resources capable of running sophisticated infrastructure services and policies independently of the host.
NVIDIA BlueField uses this programmability to support different deployment models through configurable security boundaries. Operators can determine which capabilities to enable, how interfaces are exposed and how infrastructure access is controlled.
For example, a cloud provider can place tenant workloads and the host operating system in one trust domain while operating infrastructure services in a separate domain controlled by the provider.
BlueField supports configurations that can be locked into cryptographically attestable trust profiles, helping operators establish and verify intended security boundaries.
The presence of a capability or interface does not mean every deployment must expose or enable it. Secure infrastructure design requires defining the appropriate trust model and configuring the platform accordingly.
Memory-access protections are an important example. DPUs, GPUs and management controllers can read and write system memory directly through direct memory access. Eclypsium’s research demonstrates the importance of host controls such as IOMMU translation, PCIe access control services and address translation services. Eclypsium enables operators to verify the configuration of critical hardware settings rather than assume it.
This flexibility enables organizations to balance security, performance and operational requirements without imposing a one-size-fits-all architecture.
Extending Infrastructure Security Through the Ecosystem
Security capabilities built into infrastructure provide the foundation for protection. Cybersecurity partners can build on that foundation to address additional operational requirements.
Eclypsium brings complementary capabilities focused on infrastructure visibility, firmware integrity, configuration assessment and ongoing monitoring. Eclypsium AI Infrastructure Assurance verifies hardware and firmware against known-good baselines, identifies vulnerabilities and insecure configurations, monitors device and firmware posture, and detects drift, unauthorized modifications and persistent threats below the operating system.
For organizations seeking visibility across their environments, Eclypsium’s technologies can help identify infrastructure components, assess firmware, and detect threats, malware, vulnerabilities and configuration risks, as well as changes that may affect their security posture.
These capabilities give operators additional tools to evaluate and manage infrastructure security. Together, these capabilities independently check hardware integrity and establish trust in the underlying infrastructure based on verifiable evidence.
For example, an organization can establish an approved infrastructure configuration during deployment, use BlueField’s built-in security mechanisms to protect platform integrity and use Eclypsium’s assessment capabilities to identify unexpected configuration changes or emerging firmware risks.
The value extends beyond any single device. Modern AI infrastructure includes GPUs, DPUs, management controllers, networking equipment and other components, each contributing to the overall security posture.
Eclypsium’s broader infrastructure assessment capabilities can help organizations maintain visibility across these components as environments grow and evolve.
No single security control can establish trust across the entire AI stack. Defense in depth requires platform security, independent verification and continuous assurance working together, each providing evidence that the other layers are operating on a trusted foundation. BlueField provides security by design, while Eclypsium provides additional verification and monitoring across AI infrastructure.
Maintaining Security Throughout the Infrastructure Lifecycle
Infrastructure security does not end when a system enters production.
Devices move through manufacturing, provisioning, deployment, operation, updates, recovery, and eventual reassignment or decommissioning. Each transition introduces operational considerations that organizations must manage.
BlueField incorporates security protections throughout these stages, including secure provisioning, authenticated firmware updates, rollback protection and device attestation.
These mechanisms help establish and maintain platform integrity as infrastructure evolves.
Organizations can complement these protections with Eclypsium’s lifecycle assessment and monitoring capabilities to maintain component visibility, detect threats, malware and vulnerabilities, evaluate firmware risks and identify configuration changes over time.
This can support repeatable operational practices, including establishing an approved configuration before deployment, monitoring infrastructure during operation and reassessing relevant device state after updates or recovery.
In practice, that means treating each DPU, GPU and management controller as a first-class asset with its own firmware versions, configuration and owner, bringing it into vulnerability management alongside the host operating system, and including management-interface telemetry such as baseboard management controller and Redfish logs in security monitoring. Because these components persist across operating system reinstalls, reassessment should also follow incident response and precede reassigning hardware to a new tenant.
Different mechanisms contribute different forms of assurance. Secure boot authenticates boot components, attestation provides evidence about measured platform state and configuration assessment helps operators evaluate how systems are deployed and managed.
Each of these is necessary, and none is sufficient on its own. Boot-time measurements confirm how a system started, not how it is behaving now, and an integrity check on a model file confirms the artifact on disk, not the copy running in memory. Continuous runtime verification can help detect runtime changes. Collecting the same state from independent vantage points, such as host configuration of hardware settings, PCIe topology, management controller firmware and change history, forces an attacker to keep every view consistent, which makes compromise substantially harder to hide.
Advancing Infrastructure Security Through Research and Collaboration
Security is a continuous process of engineering, evaluation and improvement.
As infrastructure grows more complex, independent security research plays an important role in identifying potential weaknesses, challenging assumptions and advancing industry security practices.
NVIDIA brings deep product expertise, secure development practices and established vulnerability response processes. Eclypsium contributes independent security research and expertise in assessing infrastructure components, firmware and configurations.
These complementary perspectives can help translate security research into practical improvements in product protections, deployment guidance and operational practices.
The purpose of that research is to make the ecosystem stronger. NVIDIA partnered with Eclypsium to demonstrate how compromised AI infrastructure could affect a model and its reasoning while remaining undetected by stored-model integrity checks: the model file, its hash and its signature all remained valid while the model running in memory behaved differently.
This challenge is not unique to any one vendor or architecture. GPU-based, alternative-accelerator and custom ASIC systems all depend on privileged components, including host processors, accelerator firmware, management controllers, smart NICs and the mechanisms that move model data between them, that sit beneath the model and can reach the memory where it runs.
NVIDIA continues to invest in BlueField security throughout the product lifecycle, evaluating reported findings and delivering updates or guidance as appropriate.
Collaboration across technology providers, cybersecurity partners, researchers and infrastructure operators helps strengthen the broader ecosystem and supports the continued evolution of trusted infrastructure. Through efforts such as the Open Secure AI Alliance, researchers, technology providers and security teams can turn research findings into shared evaluation methods, verification checks and defenses that raise the assurance baseline for AI infrastructure.
Extending Trusted Infrastructure to Agentic AI
The next major computing transformation is already underway.
AI agents are evolving from systems that generate information into autonomous systems capable of reasoning, accessing sensitive data, interacting with tools and taking actions on behalf of people and organizations.
Protecting these systems requires infrastructure that can independently observe agent behavior, govern access, and enforce security policies in real time.
With the NVIDIA OpenShell Reference Architecture, NVIDIA is extending hardware-isolated infrastructure security into the age of autonomous AI.
NVIDIA BlueField-4 provides the infrastructure foundation for NVIDIA Sentry, a unified security software framework built on NVIDIA DOCA. Operating independently of the host and beyond the agent’s reach, NVIDIA Sentry enables out-of-band monitoring of agent behavior and real-time, in-silicon policy enforcement to help detect and contain threats.
This approach complements NVIDIA OpenShell’s software execution boundaries with an independent layer of infrastructure protection.
As organizations deploy agentic AI at scale, the security of the underlying infrastructure becomes even more critical. NVIDIA provides the mechanisms to govern and enforce safe agent behavior. Eclypsium offers additional tools to verify and monitor hardware and firmware across AI infrastructure.
The result is an operational model for trusted AI: verify the infrastructure, enforce AI execution from independent security boundaries, govern what agents can access and do, and continuously monitor each layer for changes that could break the chain of trust. Together, the companies are continuously evaluating potential attack scenarios and strengthening AI infrastructure security.
