The bus is contested space.
Every Intelligent Actuation Node carries a hardware-bound identity and authenticates the commands it executes. Approved motor, joint, and configuration data can be cryptographically bound during commissioning. Security does not depend on the rest of the robot being trustworthy - each endpoint defends itself.
Hardware-enforced, not software-promised.
The final authority boundary is governed by an isolated security domain rather than the higher-level robot application. Compromise of the upstream planner or non-secure control application does not, by itself, grant access to the secure drive-enable resource - addressing the failure mode that software-only security structurally cannot.
The safe state is non-negotiable.
Within the reference architecture, Gate_EN integrity is a profile-independent invariant: customer-selectable availability policies cannot disable or downgrade the secure domain's control of the drive-enable path. Every other trade-off bends toward protecting it, never away.
Graceful degradation, not a binary stop.
Where the system design permits continued controlled operation, Varoa can reduce command authority progressively and notify the planner before security lockout. The appropriate response is configured and validated for the customer's actuator, robot dynamics, and functional-safety architecture - instead of an all-or-nothing cutoff.
An attacker can't degrade you permanently.
Security responses are recoverable. A confirmed attack triggers a safe lockout that is cleared by re-establishing trust - it is a circuit breaker, not a brick. And a system under harassment can never be tricked into permanently throttling itself; the wear-management and the security paths are kept strictly separate.
Honest security - no theater.
We build the strongest real barrier the hardware allows, and we are candid about where it ends. A control that looks protective but a capable attacker can simply walk around is not a feature we ship.
Auditability is a first-class output.
Security events are designed to produce authenticated records that support fleet-level investigation, comparison, remediation, and compliance evidence. This signed chain of custody is the core of what you're buying.
Designed for compliance readiness, complementary to safety.
Varoa provides actuator-level technical controls, signed evidence, and integration artifacts designed to support IEC 62443-oriented engineering and manufacturer readiness for the EU Cyber Resilience Act and Machinery Regulation. It secures command authority and works alongside your functional-safety systems (such as Safe Torque Off) - it does not replace them. Product conformity remains the responsibility of the manufacturer and the applicable assessment process.
Security you can inspect, degrade gracefully, recover from, and prove. That's the foundation we think the next decade of autonomous robotics has to stand on.