By its very name, HSM implies hardware. As such, most security professionals assume that all
HSMs actually store cryptographic keys in hardware, as Luna SA does by default. In fact, while
other leading HSMs generate their keys in hardware, they actually store the cryptographically
wrapped keys on an application server. These keys, residing in software, can be easily
detected—creating an additional attack surface.