An apparatus (100; 330; 470; 601) comprising: - integrated circuitry including internal circuits (117; 338; 484; 616) having sensitive/secret data, SSD (106; 336; 476; 607), to be maintained as confidential relative to a suspect Hardware Trojan, HT (109; 349; 471; 615), and including access ports (113, 111; 339, 337; 481, 479; 619, 618) through which information associated with the internal circuits (117; 338; 484; 616) is accessible by external circuitry associated with the HT (109; 349; 471; 615); and - a further circuit (110; 340; 478; 610) to learn behavior of the internal circuits (117; 338; 484; 616) that is unique to the integrated circuitry under different operating conditions involving the internal circuits (117; 338; 484; 616), involving the SSD (106; 336; 476; 607) and involving other data (104; 334; 474; 605) that is functionally associated with an application of the integrated circuitry; wherein the further circuit (110; 340; 478; 610) is a heuristics-operative circuit; and wherein the further circuit (110; 340; 478; 610) is further: to observe (222, 562) regular channels (113; 339; 481; 619) of the internal circuits (117; 338; 484; 616) for regular channel data and to observe (226; 564) side channels (111; 337; 479; 618) of the internal circuits (117; 338; 484; 616) for side channel data; to correlate (224, 563) modified SSD with the regular channel data and to correlate (228, 565) modified SSD with the side channel data; and to provide (229; 566) a message in response to the correlation exceeding a threshold. - integrated circuitry including internal circuits (117; 338; 484; 616) having sensitive/secret data, SSD (106; 336; 476; 607), to be maintained as confidential relative to a suspect Hardware Trojan, HT (109; 349; 471; 615), and including access ports (113, 111; 339, 337; 481, 479; 619, 618) through which information associated with the internal circuits (117; 338; 484; 616) is accessible by external circuitry associated with the HT (109; 349; 471; 615); and - a further circuit (110; 340; 478; 610) to learn behavior of the internal circuits (117; 338; 484; 616) that is unique to the integrated circuitry under different operating conditions involving the internal circuits (117; 338; 484; 616), involving the SSD (106; 336; 476; 607) and involving other data (104; 334; 474; 605) that is functionally associated with an application of the integrated circuitry; wherein the further circuit (110; 340; 478; 610) is a heuristics-operative circuit; and wherein the further circuit (110; 340; 478; 610) is further: to observe (222, 562) regular channels (113; 339; 481; 619) of the internal circuits (117; 338; 484; 616) for regular channel data and to observe (226; 564) side channels (111; 337; 479; 618) of the internal circuits (117; 338; 484; 616) for side channel data; to correlate (224, 563) modified SSD with the regular channel data and to correlate (228, 565) modified SSD with the side channel data; and to provide (229; 566) a message in response to the correlation exceeding a threshold. to observe (222, 562) regular channels (113; 339; 481; 619) of the internal circuits (117; 338; 484; 616) for regular channel data and to observe (226; 564) side channels (111; 337; 479; 618) of the internal circuits (117; 338; 484; 616) for side channel data; to correlate (224, 563) modified SSD with the regular channel data and to correlate (228, 565) modified SSD with the side channel data; and to provide (229; 566) a message in response to the correlation exceeding a threshold.