The bus is contested space.
We treat the command bus inside a robot as hostile territory. Every actuator carries its own hardware-bound identity and authenticates the commands it executes. Security does not depend on the rest of the robot being trustworthy — each endpoint defends itself.
Hardware-enforced, not software-promised.
The safe state lives in the actuator's own power path, governed by an isolated security domain. It holds even if the robot's higher-level software or firmware is fully compromised — addressing the failure mode that software-only security structurally cannot.
The safe state is non-negotiable.
The mechanism that can cut power to a motor is the load-bearing guarantee of the whole system. It cannot be downgraded by a configuration choice, overridden by a software setting, or disabled to make a deadline. Every other trade-off bends toward protecting it, never away.
Graceful degradation, not a binary stop.
A moving joint cannot simply be switched off without dropping the machine. Under anomaly, Varoa reduces authority progressively — bleeding energy safely and giving the motion planner time to react — instead of an all-or-nothing cutoff.
An attacker can't degrade you permanently.
Security responses are recoverable. A confirmed attack triggers a safe lockout that is cleared by re-establishing trust — it is a circuit breaker, not a brick. And a system under harassment can never be tricked into permanently throttling itself; the wear-management and the security paths are kept strictly separate.
Honest security — no theater.
We build the strongest real barrier the hardware allows, and we are candid about where it ends. A control that looks protective but a capable attacker can simply walk around is not a feature we ship.
Auditability is a first-class output.
Every security event produces a signed record. When something goes wrong at fleet scale, you can show exactly what happened to that robot — and to every similar robot — and remedy it at scale. This signed chain of custody is the core of what you're buying.
Built to be certified, complementary to safety.
Varoa is designed for IEC 62443 and the cybersecurity requirements arriving with the EU Cyber Resilience Act and Machinery Regulation. It secures command authority and works alongside your functional-safety systems (such as Safe Torque Off) — it does not replace them.
Security you can inspect, degrade gracefully, recover from, and prove. That's the foundation we think the next decade of autonomous robotics has to stand on.