Secure boot The machine starts only software it can verify.
Short answer. Secure boot is a firmware feature that makes a computer start only software signed by a trusted party. Microsoft describes it as a PC-industry standard in which the firmware checks the signature of each piece of boot software, including firmware drivers, EFI applications and the operating system, and hands control to the operating system only if the signatures are valid. If a check fails, the boot stops. The UK NCSC says enabling it makes it harder for an attacker to stay on a device. Microsoft’s documentation says the Secure Boot certificates it issued in 2011 begin expiring in June 2026, so ask any vendor how firmware certificate updates are handled.
01
The chain of trust
Each stage checks the next before handing over control. The table follows Microsoft’s description of the keys and Ubuntu’s documentation of a Linux boot.
Stage
Who checks
What it is checked against
1. Firmware
The firmware itself, which holds the trusted keys in non-volatile memory
A platform key, key exchange keys, a list of allowed signers (db) and a list of revoked ones (dbx). If an entry is in both lists, the revoked list wins
2. Boot loader (shim or Windows Boot Manager)
The firmware checks its signature
The allowed list. On Ubuntu the shim is signed by Microsoft and contains the distributor’s own certificate
3. Next stage (GRUB, then the kernel)
The boot loader checks it
The keys built into the shim, such as Canonical’s on Ubuntu
4. Kernel modules and drivers
The kernel checks each one
Unsigned modules are not loaded
02
What it stops, and what it does not
It stops an unsigned or tampered boot loader or kernel from running at start-up. On Ubuntu, if any stage fails to validate the next, the boot stops.
It does not check everything. Ubuntu’s documentation notes that initrd images are not validated.
It does not protect a running system from malware or a stolen password.
It does not stop a person who can reach the firmware settings. Microsoft’s description says the firmware is locked except for signed updates or a physically present user in the firmware menus, and that the platform key can be used to turn Secure Boot off. A firmware password and a locked room matter.
It does not encrypt anything. Pair it with full-disk encryption. Microsoft says BitLocker with a TPM helps ensure a device has not been tampered with while offline.
03
Related protections
NIST SP 800-193 (May 2018) sets out guidelines for platform firmware resiliency in three parts: protecting the platform against unauthorised changes, detecting changes that occur, and recovering from attacks quickly and securely. Secure boot is one mechanism for the first part. The UK NCSC lists secure boot with other steps for locking down devices, alongside patching, application allow-listing and local firewalls.
04
Questions for a vendor
Is Secure Boot enabled and enforced on delivery, and can it be turned off without a firmware password?
Whose keys does the machine trust: the vendor’s, Microsoft’s, or both?
How are key and certificate updates delivered, including to a machine that is never online? Microsoft says certificates issued in 2011 begin expiring in June 2026.
What happens if a check fails: does the machine stop, or fall back to something unsafe? Is there a documented recovery path?
Can the owner enrol their own keys?
Are firmware updates signed, and who applies them?
Is a firmware password set?
05
Where ANVE stands
ANVE’s security page (/security) says secure boot and full-disk encryption are part of the appliance image, which is not on ANVE yet. It also says signed update packages applied offline by USB are not on ANVE yet; today ANVEAI installs updates on site, and ANVE does not update itself over the internet. No sealed unit exists yet, so there is no boot chain to inspect. When one does, put the questions above to ANVE in writing.
06
Questions people ask
Is secure boot the same as encryption?
No. Secure boot checks that the software that starts is trusted. Encryption makes stored data unreadable without a key. The two are used together.
Can secure boot be turned off?
Usually, by someone with access to the firmware settings, which is why a firmware password and a locked room matter. Microsoft’s description says a physically present user in the firmware menus can still change what is locked.
Does secure boot stop ransomware?
No. Ransomware runs after the operating system has started. Secure boot protects the start-up chain.
Does secure boot need an internet connection?
Not for the check itself. Microsoft says the keys and revocation lists are stored in the firmware, so verification happens locally. Updates to those lists must still arrive somehow, which matters for an offline machine.
07
What is not real yet
No sealed ANVE unit exists; every image of the appliance on this site is a labelled render. The software runs today on a development machine. No customers yet, no certifications, no delivery date, and the final price is not announced.
Reservations are ₹999 in India or US$12 elsewhere, refundable in full until you confirm an order in writing (terms). Offices that cannot use cloud AI can apply to be one of ten design partners.
