THE FIVE MINUTE EXPLAINER
What is attestation?
Cryptographic proof that a machine is running exactly the code you expect. A verifiable fact you can build policy on.
The short version
Attestation is how a device answers the question are you who you say you are, running what I expect? using math instead of a promise.
The device measures its own state, which includes firmware, memory, and configuration, and produces a cryptographic proof. The CAMA verifier checks that proof against a known good reference. If anything got tampered with, the proof fails. If everything checks out, the proof passes. It happens in milliseconds, continuously, at runtime.
Two ways to think about it
It's a fingerprint match, for code.
A fingerprint scanner does not ask if you look trustworthy. It compares your print to a reference and returns a yes or no. Attestation works the same way for software. The device produces a cryptographic fingerprint of what it is running, the CAMA verifier compares it to what should be running, and you get an answer in milliseconds.
It's a health checkup, on a schedule.
You don't wait until you're sick to see a doctor. You check regularly. Attestation is continuous. Every heartbeat, the device proves it is still running the code you approved. The moment something drifts, you know.
How it works, in three steps
Same three step loop whether the target is a Kubernetes pod or an ARM Cortex M microcontroller.
Measure
The device computes a cryptographic fingerprint of its current state, including the firmware image, running processes, kernel modules, and configuration.
Prove
The device produces a tamper evident cryptographic proof of integrity, protected by device unique material. Impossible to forge, impossible to replay.
Verify
The CAMA verifier compares the proof to the known good reference. Pass means keep running. Fail means alert, isolate, or self heal.
What makes CAMA's attestation different
Same math as TPM based schemes. Very different footprint and scope.
Near zero overhead
Runs on the smallest microcontrollers without touching real time performance. Milliseconds instead of seconds.
Bit level integrity
Verifies every bit and byte, not just a header hash. Catches the kind of tampering that gets past signature only schemes.
Continuous, not one shot
Boot time attestation is a snapshot. CAMA runs at runtime, repeatedly, deterministically, across the fleet.
Adaptable to what you already run
Cloud VMs, containers, PLCs, sensors, FPGAs. One protocol, integrated into your existing stack.
FIPS certified cryptography
The cryptography underneath is federally certified. Compliance you can point at instead of paper over.
Works air gapped
Attestation results do not require phone home. Fully offline verification is supported for enclave and classified environments.
Where attestation gets used
Everywhere trust is a runtime problem instead of a design time one.
Prove your production containers match what you shipped.
SBOM verification, image integrity, and runtime policy, enforced in the pod itself instead of by a scanner watching from outside.
Prove a drone's firmware wasn't tampered with mid mission.
Attestation survives contested comms. If it fails, the device self heals or fails safe with no operator in the loop needed.
Detect a PLC anomaly before the grid feels it.
Continuous integrity checks on substation controllers, breakers, and SCADA endpoints, with alerts fed straight into your existing SOC.
Turn annual audits into continuous evidence.
CMMC, NIST SP 800-171, IEC 62443, EO 14028. Regulators are moving from checklists to continuous monitoring. Attestation is the primitive that makes it possible.
Want to see it prove something?
Book a 20 minute demo. Bring your hardest asset such as a legacy PLC, a Kubernetes pod, or an air gapped controller. We will show you attestation running on it.