Microsoft is significantly expanding its Azure Cloud HSM service with Marvell’s LiquidSecurity PCIe hardware security modules, a strategic move that embeds cloud‑native, high‑density cryptographic acceleration directly into hyperscale server infrastructure. The decision, confirmed by Marvell on August 18, 2025, extends an existing relationship that already placed LiquidSecurity adapters inside Azure Key Vault and Azure Key Vault Managed HSM, and it marks a decisive industry bet on PCIe‑attached HSMs over traditional rack‑level appliances.
Azure Cloud HSM itself is a single‑tenant, highly available hardware security module cluster that hands customers full administrative control over cryptographic keys while Microsoft manages availability, patching, and lifecycle operations. With the Marvell expansion, that cluster will now be built on DPU‑accelerated PCIe cards, a form factor that rewrites the economics and density of cloud‑scale key management. For Microsoft, it means compressed rack space, lower power consumption per cryptographic operation, and a faster path to meeting the most demanding compliance requirements across regulated sectors.
The Lay of the Land: What Cloud HSM Actually Delivers
Before unpacking the Marvell impact, it helps to understand the Azure Cloud HSM proposition. Unlike the multi‑tenant Azure Key Vault – which shares hardware across many customers – Cloud HSM provisions dedicated, tamper‑resistant hardware exclusively for a single customer. That isolation is critical for workloads that must satisfy sovereignty rules, payment card industry (PCI DSS) mandates, or government certifications such as FIPS 140‑3 Level 3. Microsoft’s service validates to exactly that level, ensuring that the hardware lifecycle, key generation, and cryptographic operations meet the strictest U.S. and international standards.
Customers retain complete ownership of their key material and cryptographic policy, while Azure shoulders the heavy lifting of hardware high availability, firmware updates, and failover. In practice, this gives enterprises the control of an on‑premises HSM without the capital outlay, floor space, and 24/7 physical security requirements.
From Appliances to PCIe: Why Marvell’s Approach Matters
Historically, HSMs shipped as bulky 1U or 2U appliances, each with a fixed cryptographic capacity that forced cloud providers to over‑provision and underutilize. Marvell’s LiquidSecurity flips that model. The adapters slide into standard PCIe slots on servers that would otherwise be running virtual machines or containers, turning every server into a potential cryptographic node. The silicon is driven by Marvell’s OCTEON DPUs, which offload encryption, decryption, signing, and key management tasks from host CPUs, reducing jitter and freeing cycles for customer workloads.
According to Marvell’s published engineering figures, each LiquidSecurity card can expose multiple virtual HSM partitions – numbering in the dozens – while managing hundreds of thousands of keys. Those numbers are manufacturer specifications and will require independent validation under production workloads, but they outline the architectural ambition: a single card can serve many customers with hardware‑backed isolation, making the unit economics of cloud HSM services dramatically more competitive.
That partitioning capability is the linchpin for hyperscalers. Without it, a provider would need to install entire rows of appliances to serve a fraction of their customer base. With it, they can allocate dedicated cryptographic silos on‑demand, scale elastically, and bill with fine granularity. For Microsoft, LiquidSecurity becomes the plumbing that lets Azure Cloud HSM scale to meet growing demand from financial institutions, healthcare organizations, and government agencies migrating sensitive workloads to the cloud.
Compliance Without Compromise: FIPS 140‑3 Level 3 and Beyond
Regulated industries won’t touch a cloud HSM unless it carries current, audited certifications. Marvell secured FIPS 140‑3 Level 3 for its LiquidSecurity modules, a designation that requires physical tamper evidence, identity‑based authentication, and stringent operational testing. Microsoft then layered that certification into Azure Cloud HSM’s service offering, rolling out validated clusters across multiple regions.
This is not a static rubber stamp. FIPS validation applies to specific firmware and hardware combinations, so any future firmware patches, new card revisions, or SKU changes will require re‑validation or at least a coordinated governance process between Microsoft and Marvell. For enterprise buyers, that means reading the fine print: the certification you see in a portal may be tied to a particular BIOS version, and you’ll want written confirmation that the cluster version your tenant lands on is the one that passed the lab tests.
For post‑quantum readiness, the community feedback highlights a growing demand for field‑upgradeable firmware that can accommodate new algorithms without a complete hardware swap. Neither Microsoft nor Marvell have publicly committed to a specific PQC timeline for this generation of cards, but the requirement is building quickly as standards bodies finalize quantum‑resistant algorithms. Procurement teams are already writing it into their RFP checklists.
Operational Models: Single‑Tenant Control Meets Hyperscale Economics
Azure Cloud HSM with LiquidSecurity cards gives customers two powerful modes of operation. The first is single‑tenant clusters, where a dedicated set of PCIe cards – likely distributed across multiple servers for fault tolerance – forms a customer’s private HSM domain. The customer defines roles, manages keys, and sets policies via a management API, while Microsoft ensures that the underlying hardware is always available and patched. This eliminates the noise of hardware monitoring without ceding control of the cryptographic material.
The second mode, though behind the scenes, is multi‑tenant partitioning at the card level. LiquidSecurity can slice a single PCIe adapter into many isolated “virtual HSMs,” each with its own key store and access controls. That allows Microsoft to host many single‑tenant clusters on a shared physical infrastructure pool, driving down per‑tenant costs without compromising isolation guarantees. For a hyperscaler, that is the difference between a niche service for a handful of banks and a broadly available SKU that can be offered to any enterprise with a compliance checkbox.
Performance Headlines and the Need for Independent Benchmarking
Marvell touts high per‑card throughput and low latency, leveraging OCTEON DPU offloads that accelerate symmetric algorithms (AES), elliptic curve cryptography (ECC), and the RSA operations that still dominate legacy enterprise workloads. The numbers are directional indicators, not finished benchmarks. Real‑world performance will vary depending on the mix of algorithms, the concurrency model, and whether the application is latency‑sensitive (think real‑time payment authorizations) or throughput‑sensitive (bulk file encryption).
Community voices on windowsforum are already calling for transparent, independent benchmarking, and rightfully so. In security products, marketing figures often measure best‑case scenarios with unrealistic workloads. Enterprises planning a migration should demand to run pilot tests against representative traffic patterns before committing production data. Latency tail behavior, in particular, can break transactional systems, and it’s rarely captured in datasheet tables.
Market Forces: HSM‑as‑a‑Service on a Growth Trajectory
The broader HSM‑as‑a‑Service market is expanding as enterprises and regulators grow comfortable with cloud‑hosted key management. Research firms like ABI Research have forecast a market opportunity worth over $229 million by 2027, while other analysts publish even larger numbers depending on how they define the addressable segment. Whatever the exact figure, the trend is clear: more workloads that once required physical on‑prem HSMs are moving to cloud services, and the providers that offer certified, cost‑effective options will capture the lion’s share.
Microsoft’s deepening partnership with Marvell puts it in direct competition with traditional HSM appliance vendors like Thales, Utimaco, and Entrust, as well as with other hyperscalers that are exploring in‑house silicon or partnerships with competing adapter makers. The LiquidSecurity design win is a strategic moat of sorts – it gives Azure a differentiated architecture that blends high density with strong isolation – but it’s not an impenetrable one. Competitors can license similar DPU technology or develop their own. The market will eventually converge on a mix of PCIe cards, smart NIC‑based HSMs, and software‑defined approaches, with certification depth and operational ease becoming the differentiators.
Investor and Industry Implications
From a business perspective, the news lands as a powerful validation of Marvell’s cloud‑security pivot. Having a marquee hyperscaler expand usage of LiquidSecurity reduces commercial risk for other cloud customers considering the technology and strengthens Marvell’s narrative that DPU‑accelerated HSMs are the future. However, design wins do not equal immediate revenue. Hardware production ramps take quarters; Microsoft’s rollout of new Cloud HSM regions will be gradual, and bulk procurement agreements often come with aggressive discounting that pressures margins.
Investors should watch for concrete disclosures in coming earnings calls: revenue attribution for the security and custom silicon segment, gross margin trends on adapter cards, and commentary on multi‑year purchase commitments. As the Simply Wall St analysis framed it, the announcement is a potential positive catalyst but not a de‑risking event for Marvell’s broader concentration challenge. A significant portion of Marvell’s data‑center revenue still comes from a handful of large customers, and any shift in those customers’ architectures – for instance, a decision to insource HSM silicon – could materially swing the top line. The LiquidSecurity win is a milestone, not a final destination.
For enterprise security buyers, the calculus is more practical. The Azure Cloud HSM expansion means they will have access to FIPS‑certified, PCIe‑based clusters that promise lower latency, higher density, and more granular scaling. But they must do their homework: verify certification coverage for their exact region and SKU, run pilot benchmarks under real‑world load, negotiate strong SLAs around firmware patching and incident response, and insist on a clear post‑quantum cryptography roadmap. The smartest teams will also maintain a multi‑vendor exit strategy, keeping backup HSM paths (either on‑premises or with another cloud) for their most critical root keys.
What Comes Next
The Microsoft‑Marvell expansion is a forward‑looking statement in metal and silicon: cloud HSMs are leaving the appliance rack behind and spreading into every server that demands high‑assurance cryptography. In the near term, Azure customers with strict compliance mandates will have a new performance‑oriented option that may finally bring HSM latency into the sub‑millisecond territory required by modern microservices. In the medium term, expect competitive responses from other cloud providers and HSM vendors, accelerating the entire market’s shift toward DPU‑based security cards. And in the long run, the move lays a foundation for post‑quantum key management at cloud scale – provided the firmware and validation pipelines keep pace with cryptographic standards.
The only certainty is that the old model of a standalone, rack‑heavy HSM is fading. In its place is a disaggregated, software‑orchestrated architecture that treats cryptographic hardware as a pooled resource. Microsoft and Marvell just made that vision a whole lot more concrete – and a whole lot more accessible to the enterprises that need it most.