A device including memory protection, comprising: a memory module including at least a flexible counter system, wherein the flexible counter system comprises at least one data line (120A-120D) stored in the memory module, the at least one data line (120A-120D) including a plurality of counters with a size of each counter determined based on a number of bits making up each counter, wherein the at least one data line (120A-120D) comprises bit flags corresponding to each of the plurality of counters, a state of each bit flag indicating whether the corresponding counter is in an overflow state, wherein the plurality of counters comprises at least one overflow counter; and a processing module including at least a memory encryption engine to at least one of decrypt encrypted data loaded from the memory module using security metadata generated at least in part by the flexible counter system, or encrypt plaintext data prior to storage in the memory module using the security metadata, wherein the memory encryption engine is to: determine if a counter in the plurality of counters is in an overflow state based on the bit flag corresponding to each counter to indicate the counters that are currently relying upon overflow counter; and determine a counter value by combining a current value of the overflow counter and a current value of the counter when the counter is determined to be in an overflow state, and to determine the counter value based on the current value of the counter itself otherwise. a memory module including at least a flexible counter system, wherein the flexible counter system comprises at least one data line (120A-120D) stored in the memory module, the at least one data line (120A-120D) including a plurality of counters with a size of each counter determined based on a number of bits making up each counter, wherein the at least one data line (120A-120D) comprises bit flags corresponding to each of the plurality of counters, a state of each bit flag indicating whether the corresponding counter is in an overflow state, wherein the plurality of counters comprises at least one overflow counter; and a processing module including at least a memory encryption engine to at least one of decrypt encrypted data loaded from the memory module using security metadata generated at least in part by the flexible counter system, or encrypt plaintext data prior to storage in the memory module using the security metadata, wherein the memory encryption engine is to: determine if a counter in the plurality of counters is in an overflow state based on the bit flag corresponding to each counter to indicate the counters that are currently relying upon overflow counter; and determine a counter value by combining a current value of the overflow counter and a current value of the counter when the counter is determined to be in an overflow state, and to determine the counter value based on the current value of the counter itself otherwise. determine if a counter in the plurality of counters is in an overflow state based on the bit flag corresponding to each counter to indicate the counters that are currently relying upon overflow counter; and determine a counter value by combining a current value of the overflow counter and a current value of the counter when the counter is determined to be in an overflow state, and to determine the counter value based on the current value of the counter itself otherwise.