SemiWiki.com - Podcast EP347: Agentic Workflows from Caspia Technologies for Advanced Chip Security Verification with Stuart Audley

Episode Date: May 22, 2026

Daniel is joined by Stuart Audley, vice president and general manager of product management at Caspia Technologies, where he focuses on agentic security workflows. He has decades of experience designing and deploying cryptographic hardware and security IP for top defense and leading semiconductor companies. He previously… Read More

Hello, my name is Daniel Nenny, founder of Semaywiki, the Open Forum for Semiconductor Professionals. Welcome to the Semiconductor Insiders podcast series. My guest today is Stuart Audley, Vice President and General Manager of Product Management at Caspia Technologies, where he focuses on agentic security workflows. He has decades of experience designing and deploying cryptographic hardware and security IP for top defense and leading semiconductor companies. He previously led advanced security platform development for FPGAs and ASICs at the Athena Group and Mercury Systems. Welcome to the podcast, Stuart. Hi, thanks, Dan. Great to be here.

So let's start with what brought you to Caspia. Yeah, so back when I started my career, I focused on signal processing IP and security IP. And, you know, over the years, got to develop encryption IP, root of trust IP for lots of the main. major semiconductor and defense companies out there. And one of the things that really excites me about Caspia is how it's taking security IP and verifying that there are no threat spaces that can be attacked with that security IP. So it's an exciting to be on the other end. Basically, now we're creating a tool that can verify the security IP that I used to develop.

And I really wish we had a tool like that back when I was doing development. One interesting thing back when I was in the early stages of my career was we were actually developing a high-speed FFT IP Corps for one of the biggest semiconductor companies in the world. And you know, everything passed in simulation, and then they got to emulation. And the outputs of simulation and emulation didn't match. We spent three weeks going back and forth with them. Everybody on their team and our team was looking at every signal in the simulation,

trying to figure out where the difference was. It turned out just to be a bad reset on their side, yet we spent three weeks doing it. So one simple signal had stalled this multi-million gate design for almost a month. And, you know, kind of those type of issues stuck with me. And gosh, wouldn't it have been nice to have a tool that would have solved that? Well, now what Caspi is doing is they're finding those small but critical issues in the security domain. So you don't miss that small vulnerability that, you know, just looking at code would have missed. And you can save weeks, months, even years, so you don't have to do a respin.

I think that's really the value that Caspia is offering now is that you can perform your security verification on your RTF throughout your whole. design life cycle. Great story. Yeah, let's talk a little bit more about that. So Caspia Technologies focuses on hardware security verification. And, you know, there's been a lot of talk about chip level security lately. You know, can you explain why this is such an important topic now? Yeah, yeah.

So verification in chips used to just be about functional correctness. For instance, you know, like I mentioned, the FFT, make sure the FFT results are what you expect. But then, of course, security comes into the topic where you need to be able to secure your IP that lives on the chip and make sure an adversary can't gain control of your chip and your systems. So you have to have those, you know, hardware security route of trusts. And those root of trust, decade ago or so, we're just assumed, okay, they work, they have encryption. we check that functional encryption and everything's good. But of course, as we've seen with a number of hardware security vulnerabilities like Specter,

meltdown, fault injection attacks, different side channel attacks, that assumption is incorrect. There is an always growing set of vulnerabilities in the hardware space that every semiconductor company needs to pay attention to and try to do their best. to stop those type of attacks from affecting their systems. Okay, that makes sense. How does AI fit into this picture? Yeah, so AI has been used a lot in the software world to analyze and expose security vulnerabilities.

So if you look at the latest models that are coming out from the Frontier Labs, they can find a lot of vulnerabilities in, you know, different types of code like JavaScript, Python, even binary executables. So one could imagine that this type of capability might translate into the world of RTL and hardware design. But it really doesn't, mainly because these frontier models haven't been trained on a lot of RTL and just don't have that world model to be able to take in a whole SOC design and do a security analysis on it. So that's where tools like Caspia's security verification technology comes into play. So we incorporate various levels of parsing and

elaboration to look at the design closely and then hand the AI very specific vulnerabilities that it can then put into context. And also use the AI to help find those needle and haystack type of aspects. So you can have an AI look at, well, where is your key in your system? Where is your configuration registers? And with that information, you then use these special deterministic tools to pinpoint where the possible security vulnerabilities are in your system. And this approach really allows the end user to have a full system that utilizes the best parts of AI at the same time using the best parts of a security expert.

And in the end, they get a context-aware security report that allows them to really figure out where are those vulnerabilities in my system. How do I fix them? and how can I fit this into my design lifecycle? So with these tools, you can hook them up into your continuous integration flow. And at every moment in your design lifecycle from, you know, your architectural design to your first drafts and commits of RTL to your code freezes and your tape-out audits, you can run our Caspia verification tools to ensure that you don't have any new security vulnerabilities inserted into your hardware design at each step.

And what this does is it really gives a huge cost savings because at every step in that design lifecycle, the cost of finding a vulnerability doubles or more than doubles. So at the end, if you let one of those security vulnerabilities go past, after your tape out, then it's going to be extremely expensive compared to when, if you can find that at your draft RTL level or even later at one of your design commits, that's a huge deal. That's a huge cost savings that the combination of Caspia's deterministic software combined with its AI techniques allows organizations to save lots of engineering hours. And if it saves you a tapeout, that's a huge, huge cost savings.

Yeah, you know, in my experience, I've seen re-spins kill products, but I've also seen them kill companies. So this is a very serious issue and something that we're seeing more and more with the complexity we're seeing with these AI chips. So can you tell me a little bit how do agentic workflows fit into the picture? Yeah, definitely. So the agentic workflow is something that we've really been focusing on. And there's really kind of you might have heard of something called the agentic loop.

And so there's really kind of two type of agentic loops that Caspia focuses on to make this agent verification real. One of the loops is between the agent and the engineer. And that's about how do you hand off between the tool and the human and how does the human trust that tool? And then the other loop is between the agent and the design itself. So that's about how do you have autonomous capabilities and convergence? And some customers look at one or the other, but really at Caspia, we look at both.

So on the human handoff side, you have verification engineers that have a lot of experience. And they don't necessarily want the tool to do everything for them. And they know which signals matters. They know the corner cases. maybe they just want a tool to help them increase their productivity. So, for instance, the agent can help load a full SOC design over an MCP, which is like kind of how AI talks to tools. And they can just have them load a design up.

Say, I want to load this design from this Git repo and it loads it. Then the human can take over and say, okay, you loaded it, thank you. and then start running their design with our security verification. They might also say, hey, you know, I want you to look at, you know, try to find some assets, try to find where the keys are in this design. And our tool will allow the human to say, okay, that key is correct, but that key, you really misunderstood what you were looking for in your AI system. Let me correct that.

And then you can run this loop of the humans basically and the engineers control, the tool with AI assistance, but never at one point is the AI fully in control. So then you have the second type of loop where you're basically you have code generation and you have security verification all automated. And this is the type of loop that is probably more in the future where you might have AI generated RTL as technology gets better, but there's still are security vulnerabilities that are possible in that generated RTL. So what our security tools can do is they can automatically using MCP connections, read the design, run the security vulnerability analysis, suggest actions, go back to the agent orchestrator,

and then the agent orchestrator can correct them, and then rerun the security verification, and close that loop. So it's all autonomous. And really what we're focused on is being able to support both models. And we've been very successful in how to handle that human in the loop at the same time, the more future type of system where it's all automated. That's helpful. So can you give me some examples of agents, Caspia is developing and how they work together? Yeah, sure. So one of our tools is coding. Act, which is an RTL static security analysis tool. And there's really two LLM powered agents that wrap around it. There's asset assist, which helps engineers identify those security relevant

assets in their design, you know, kind of what's sensitive, what needs protection, where are the trust boundaries. And we used to have a way of just having the security architects very define all of those assets in a system. But now we have kind of LLMs, taking a look in trying to identify where those assets are. Then, in addition, you have a report assist, which helps put context around these vulnerabilities that happen. So, you know, where in the system is this vulnerability found? How might it affect the rest of the system?

And that's very important. Then on the formal side, so on the formal verification side, we have SVX. And that actually uses multiple agents. And it generates system varilog assertions where it has to understand the verification plan, the security model, the timing relationships between signals, the threat models. And SVX integrates these multiple LLM agents to all talk with each other and each takes one small piece of it. And then it does the collaboration where it produces these kind of robust assertions that are then formally provable with any EDA formal tool that actually capture what the security

intent is. And it really allows customers to both see what is security important in their system and look at those assertions and then have also corresponding kind of human research. assertions associated with that. So sometimes formal assertions can be pretty cryptic and having it say, well, what we're really checking for is that this encryption algorithm runs in constant time, just being very clear about that. And so it's basically taking multiple LLM agents

and using them all together to create a robust security assertion. Using all these specialized agents in combination with these deterministic engines is really what scales and what allows our customers to utilize AI throughout all their many designs. So there's one real benchmark that we've done with Calyptra, which is a hardware security route of trust in the open source world. And we can actually take the RTL from that repo and audit. automatically from asset identification to find context-aware security vulnerabilities to proposing actionable fixes, we can do all that workflow in less than an hour. Whereas might take a security verification engineer on their own weeks or even months to do that. when you incorporate the Caspia verification security tools into your organization and into your continuous integration flow with all your design, it can literally save many large organizations

years of engineering effort. Interesting. Great discussion, Stuart. Thanks again for joining us. Last question. How can folks learn more about Caspia's agentic security verification? Yeah, so you can go to caspia.a.a.i. We have a contact form and we can have, you know, set up a quick call with you and do guided demos of one of the open source designs that we do, or even with one of your own designs, we can set up an e-val for you to see it. We work with a number of the major EDA vendors to incorporate their tools into our flows. And we can, you can, you know,

can talk to you at the next conference that we'll be going to, which will be the design automation conference in California this July. I'll see you guys at Dak. I also saw you at DBCon. You guys are very active in the ecosystem. That's great. So hopefully, Stuart, come back and talk to us, maybe later in the year and give us an update. And thanks again for your time. Yeah, happy to do so. And thank you so much for having me on. That concludes our podcast. Thank you. all for listening and have a great day.