A Hardware Security Module (HSM) is specialized hardware designed to generate, store, and use cryptographic keys inside a protected device. Sensitive key material is meant to stay within the module, so even administrators and host systems cannot easily extract it. HSMs also perform operations such as encryption, decryption, signing, and key wrapping while keeping the keys isolated.
HSMs matter because key compromise can defeat otherwise strong encryption. In cloud and enterprise environments, they help enforce separation of duties, protect root keys, and support audits by limiting who can access or use keys. Defenders use HSMs for certificate authorities, payment systems, disk encryption, and centralized key management. Attackers often target the systems around the HSM instead: over-permissioned identities, weak policies, and exposed management interfaces. In practice, an HSM strengthens the cryptographic trust boundary, but it still depends on careful access control and lifecycle management.