For immediate release
London, UK — 11 November 2026 — Hildebrand Technology, the smart meter data company behind the Glow platform and Bright mobile app, today announced the Hildebrand Glow series: the world’s first smart meters secured with CHERI (Capability Hardware Enhanced RISC Instructions) technology. Available in single-phase, three-phase and three-phase CT variants, the new Glow meters are built on early ICENI silicon from SCI Semiconductor, the first commercial CHERIoT microcontroller to reach production. The meters have been developed through the UK Government-funded CHERI Secure by Design Managed Deployment Programme sponsored by DCMS and delivered by PA Consulting.
Memory-safety bugs — buffer overflows, use-after-free errors and the like — account for approximately 70% of the serious software vulnerabilities reported each year. Until now the only defences available to a device manufacturer have been patching faster than attackers or rewriting large codebases in new languages. CHERI takes a different approach: it enforces memory safety at the hardware level so an entire class of vulnerability stops being exploitable regardless of what the software does.
In the Glow series of CHERI-enabled products that protection covers every attack surface on the meter:
- Memory-safe network stacks. The TCP/IP, TLS and application-protocol stacks all run under CHERI capability enforcement so a malformed packet cannot be turned into code execution.
- Protected radios. Wi-Fi, Bluetooth Low Energy and cellular connectivity each run in their own hardware-enforced compartment. A flaw in one radio driver cannot reach the others or the meter.
- A protected metering application. The measurement, tariff and data-export functions are isolated from the communications layers, keeping the metrological core and consumer data separate from the parts of the device exposed to the network.
Compartments for resilient operation
Glow meters use CHERIoT’s compartment model, which splits the firmware into small, mutually distrusting units, each holding only the permissions it needs. If a component fails or is attacked it faults within its own compartment and can be restarted independently while the rest of the meter — including the metrology — keeps running. For a device that may spend fifteen years on a wall, that resilience matters as much as the security.
Lowering the risk of a software vulnerability
By enforcing memory safety in hardware, the Glow meter series substantially lowers the probability that a software defect becomes an exploitable vulnerability and shrinks the blast radius of any that remain. The approach also brings existing C and C++ code across without a rewrite: the firmware is recompiled with the CHERIoT toolchain and the hardware does the rest, with low single-digit performance overhead.
Security by design, and regulation by design
The launch builds on Hildebrand’s recent paper, How CHERI Secures Cybersecurity Compliance, which examines how hardware-enforced memory safety maps onto the security requirements now being written into law and industry codes, including the EU Cyber Resilience Act and the GB Smart Energy Code’s Commercial Product Assurance (CPA) scheme; the paper also explores the economics of compliance and liability for connected-device manufacturers.
As cybersecurity regulation shifts from guidance to conditions for market access, led by the EU’s Cyber Resilience Act, CHERI’s hardware memory safety offers manufacturers a way to meet secure-by-design obligations and remove the largest class of exploitable vulnerability across a product’s lifetime. Mapping CHERI against obligations from the CRA and requirements in the UK’s CPA certification scheme shows that CHERI secures the technical core of both regimes, in terms of risk assessment, exploit mitigation, attack-surface design, testing and incident severity.
Quotes
“Smart meters sit at the edge of critical national infrastructure and they stay in service for a very long time. We wanted a meter whose security did not depend on winning every patch race for fifteen years. CHERI gives us that — memory safety is enforced by the silicon, not promised by the software — and ICENI meant we could ship it now rather than wait. None of this would have happened without the UK government’s backing of CHERI through DCMS and the Secure by Design Managed Deployment Programme: it took a decade of research out of the lab and put it in our hands as something we could build a product on. This meter is what that investment was for.”
“Hildebrand’s CHERI-secured smart meters are a powerful demonstration of what this programme is about: moving breakthrough cyber technology from research into real-world deployment. PA is proud to lead the Secure by Design Managed Deployment Programme, bringing government and industry together to overcome the barriers to adoption and demonstrate how CHERI can strengthen the resilience of the critical systems we all depend on.”
“CHERI is cybersecurity’s seatbelt moment. By eliminating entire classes of software vulnerabilities in hardware, CHERI has the potential to transform security across almost everything, from critical national infrastructure to the connected devices we rely on every day. As our world becomes ever more connected and AI enabled, CHERI will provide the trusted foundation that keeps these systems safe; in ten years’ time we’ll wonder how we ever survived without it.”
Availability
The Hildebrand Glow single-phase, three-phase and three-phase CT meters are available to the market today; the CHERI-enabled variant is undergoing certification. Technical specifications and compliance documentation are available on the Glow metering site. See also the Glow electricity meters on this site.
About Hildebrand Technology
Hildebrand Technology Limited is a UK company operating in the energy sector; Hildebrand are recognised innovators, using technology (hardware and software) to support the drive to net zero. Hildebrand’s Glow platform offers energy consumers, commercial customers, energy suppliers and researchers secure access to energy consumption data. Hildebrand is a SECAS-approved DCC Other User operating its own connection to the national smart metering network. Its Glow in-home displays and consumer access devices are among the only DCC-approved devices giving households real-time access to their own meter data, and the company manages data for more than 700,000 meter points across Great Britain.
About SCI Semiconductor
SCI Semiconductor is a Cambridge, UK company formed to commercialise CHERI technology and a founder member of the CHERI Alliance. Its ICENI family of RISC-V microcontrollers, based on the open-source CHERIoT platform originated by Microsoft Research, is the first CHERIoT design to reach silicon.
About CHERI
CHERI (Capability Hardware Enhanced RISC Instructions) is a processor-architecture extension developed by the University of Cambridge and SRI International, with support from DARPA and the UK’s Digital Security by Design programme. It replaces raw pointers with hardware-checked capabilities, enforcing memory safety and fine-grained compartmentalisation at the instruction level. Adoption is promoted by the CHERI Alliance.
About the CHERI Secure by Design Managed Deployment Programme
The CHERI Secure by Design Managed Deployment Programme is a UK Government-backed programme led by PA Consulting in collaboration with the Department for Digital, Culture, Media and Sport (DCMS). It brings together asset owners, OEMs, semiconductor companies and other ecosystem partners to accelerate the adoption of CHERI-enabled technologies across critical sectors, addressing the technical and non-technical barriers that stand between proven technology and deployment at scale.