A secure performance monitoring unit of a processor includes one or more performance monitoring counters and a secure group manager. The secure group manager is configured to receive a request to create a secure counter group from a software (SW) process being executed by a processor, the request including identification of the one or more counters; determine availability of the one or more counters, creating the secure counter group, assign the one or more counters to the secure counter group, and save a public key of the SW process, when the one or more counters are available; receive and save a private key for the secure counter group; receive a request to configure the secure counter group from the SW process; verify the configuration using the public key of the SW process; and begin sampling of the one or more counters when the configuration is verified.