RAM provenance is the origin and authenticity of the memory chips installed in a device. It asks whether the modules are genuine, approved, replacement, third-party, or counterfeit hardware. In cyber security, provenance checks matter because memory is part of the trusted computing base: if firmware cannot trust the RAM it boots with, the whole platform may be treated as untrusted.
In practice, RAM provenance can be used defensively to enforce platform policy, detect unauthorized hardware changes, or prevent known-bad components from running. But the same mechanism can also become a denial-of-service risk if the identification logic is too strict, undocumented, or mistaken. Attackers may try to bypass provenance checks by swapping parts, while defenders use them to validate supply chains and maintain device integrity before the operating system starts.