DuoKey

Cryptographic Posture Management

DuoKey vs Fortanix

Fortanix offers Key Insight with its PQC Central module, a SaaS discovery and posture service with an on-premises scanner, and remediates through its Data Security Manager key management platform. DuoKey CPM is a Swiss cryptographic posture platform: discovery across code, cloud KMS, HSMs, appliances and TLS, a CycloneDX CBOM, a readiness score and a migration roadmap, hosted by DuoKey or on your premises.

DuoKey

26 / 34

Fortanix

9 / 34

Compared capabilities supported, based on public documentation.

Book a call→See the comparison

Only DuoKey

  • Source code (SAST)
  • HSM key inventory
  • SSH
  • ITSM/CMDB sync and ticketing (ServiceNow, Jira, Azure DevOps)
  • Per-asset risk score and prioritisation
  • Dashboards and executive/board reporting
  • Custom/internal crypto policy import
  • Hybrid PQC rollout guidance
  • Issue PQC (ML-DSA/hybrid) certificates and deploy/rollback them
  • Central crypto policy enforcement and drift detection
  • Policy-change simulation (what-if)
  • Vendor-neutral key custody for PQC keys (HSM/MPC/KMS integration)
  • CI/CD gating (SARIF, fail on severity)
  • Both agent-based and agentless discovery
  • AI-agent / MCP access
  • SaaS and on-premises options
  • Free self-service assessment or trial

Feature by feature

DuoKey and Fortanix, side by side

CapabilityDuoKeyFortanix

Discovery

1Network/TLS and PQ key exchange

Scan endpoints, certificate chains, cipher suites and hybrid/PQ key exchange

YesLive PQ key-exchange probeSource
YesPassive analysis of mirrored trafficSource

2Source code (SAST)

Find cryptographic API use in code repositories

YesGitHub, GitLab, Azure DevOps connectorsSource
PartialHardcoded keys, not crypto API useSource

3Binaries / compiled artefacts

Crypto in executables, libraries, firmware

Not documentedNo binary analysis documented
PartialContainer images onlySource

4Certificates and keystores

Filesystem keystores and OS certificate stores

YesPEM, DER, PKCS#12, JKS, Windows storeSource
YesCertificates and trust stores, Linux/WindowsSource

5Cloud KMS

AWS / Azure / GCP key inventory

YesAWS production; Azure and GCP betaSource
YesAWS, Azure, GCP, OCISource

6HSM key inventory

Keys held in HSMs

YesSecurosys and DuoKey KMSSource
PartialFortanix DSM and HashiCorp Vault onlySource

7Firewalls, VPN/IPsec, load balancers

Appliance crypto configuration (FortiGate, F5, Palo Alto...)

PartialFortiGate; F5 plannedSource
Not documented

8SSH

Host and user keys

Yesssh-agent, ~/.ssh, host keysSource
Not documented

9Databases and non-HTTP TLS

Postgres, MySQL, LDAP, SMTP transport TLS

Not documentedNot in public docs
PartialKeys in Oracle and MSSQL onlySource

CBOM and inventory

10CycloneDX CBOM export

YesCycloneDX 1.7Source
YesCycloneDX JSONSource

11ITSM/CMDB sync and ticketing (ServiceNow, Jira, Azure DevOps)

YesServiceNow Store app, Azure DevOps work itemsSource
PartialServiceNow/Jira in press release onlySource

Risk

12Per-asset risk score and prioritisation

Yes0-10 score, P0-P4 prioritiesSource
PartialHeat maps (marketing)Source

13Organisation-level readiness score (single KPI)

YesReadiness score 0-100 incl. HNDLSource
YesReadiness score = % quantum-resistant keysSource

14Dashboards and executive/board reporting

YesDashboard and branded PDF reportSource
PartialSunburst dashboard; no board reportSource

Regulatory

15NIST / CNSA 2.0 mapping

YesSP 800-131A, CNSA 2.0Source
YesNIST, CNSA 2.0 algorithms in DSMSource

16BSI / ANSSI / NCSC mapping

PartialBSI in docs; ANSSI, NCSC on websiteSource
Not documented

17FINMA / DORA / NIS2 mapping

PartialStated on website, not in docsSource
Not documented

18Custom/internal crypto policy import

YesCustom PDF-based policiesSource
PartialPolicy Center (details not public)Source

Remediation and migration

19Migration roadmap from findings

YesMigration tab in CockpitSource
YesRoadmap and prioritised list (marketing)Source

20Hybrid PQC rollout guidance

YesHybrid-first with fallbackSource
Not documented

21Automated remediation (drafted fixes / pull requests, human-approved)

PartialAgentic PRs via CAP SDKSource
Not documentedRemediation through DSM; no fix PRsSource

22Issue PQC (ML-DSA/hybrid) certificates and deploy/rollback them

YesML-DSA/composite certs, F5/FortiGate rollbackSource
PartialML-DSA keys in DSM; certs RSA/ECSource

Crypto-agility

23Central crypto policy enforcement and drift detection

YesPolicies and drift via CAP SDKSource
PartialFlags non-compliant keysSource

24Policy-change simulation (what-if)

YesSimulate posture change, score upliftSource
PartialMarketing claim onlySource

25Vendor-neutral key custody for PQC keys (HSM/MPC/KMS integration)

YesHSM or optional MPC vault backendsSource
PartialOwn DSM HSM; no MPCSource

Integration

26CI/CD gating (SARIF, fail on severity)

YesSARIF, fail-on-severitySource
Not documented

27Both agent-based and agentless discovery

YesHost agent plus agentless network/APIsSource
PartialCloud via API; on-prem scanner neededSource

28SIEM export

PartialPlatform-level SIEM forwardingSource
PartialDSM logs to Splunk/syslog onlySource

29AI-agent / MCP access

YesCockpit MCP endpointSource
Not documented

Deployment and trust

30SaaS and on-premises options

YesDuoKey-hosted or on-premisesSource
PartialKey Insight SaaS plus on-prem scannerSource

31Air-gapped deployment

PartialImage mirroring; full air-gap plannedSource
Not documentedScanner needs outbound connectivitySource

32Fine-grained RBAC

YesRole-based permissionsSource
YesAdmin, Member, Auditor rolesSource

33Vendor ISO/IEC 27001 (or SOC 2) certification

YesISO 27001, SOC 2, TISAX AL3Source
YesISO 27001, SOC 2 Type IISource

34Free self-service assessment or trial

YesFree public-signal Quantum Risk ScoreSource
PartialFree trial announced 2024; terms unclearSource

Why teams choose DuoKey

Key differences with Fortanix

01

More than keys

Key Insight focuses on keys and certificates in cloud KMS, Fortanix DSM, HashiCorp Vault and file systems. DuoKey CPM also scans source code for cryptographic APIs, SSH keys, FortiGate appliances and live TLS endpoints including post-quantum key exchange.

02

Remediation into your pipelines

Fortanix remediates through DSM and IT ticketing. DuoKey CPM gates CI pipelines with SARIF, can draft remediation pull requests through its agent SDK and issues post-quantum certificates with deploy and rollback to F5 and FortiGate.

03

Plan, simulate, then migrate

DuoKey turns findings into a phased migration roadmap, simulates policy changes and their effect on the readiness score, and detects drift back to classical algorithms. These steps are not documented for Key Insight.

04

Your choice of custody

Fortanix keeps keys in its own DSM. DuoKey works with HSM backends such as Securosys or an optional Multi-Party Computation vault, hosted by DuoKey or on your premises.

What Fortanix does well

Key Insight discovers keys across AWS, Azure, GCP and OCI, exports CycloneDX CBOMs, shows a single Quantum Readiness Score with drill-down, and hands off to Fortanix DSM, which supports ML-KEM, ML-DSA, LMS and XMSS on FIPS 140-2 Level 3 hardware. Fortanix holds ISO 27001 and SOC 2 Type II.

FAQ

Is DuoKey CPM an alternative to Fortanix Key Insight / PQC Central?

Yes. DuoKey CPM discovers the cryptography in your estate, produces a CycloneDX CBOM, scores post-quantum risk and turns findings into a migration roadmap, hosted by DuoKey or on your premises.

Can I try DuoKey without installing anything?

Yes. The free Quantum Risk Score is computed from public signals, with no access to your internal systems.

How were these criteria chosen?

They follow a buyer's questions for cryptographic posture management: discovery sources, CBOM, risk, regulation, migration, crypto-agility, integration and deployment. Every cell links to the public document it is based on.

Evidence

Every claim on this page, sourced

Fortanix

  1. [1]support.fortanix.comcriteria 1, 2, 3, 9, 27https://support.fortanix.com/docs/fortanix-key-insight-on-premises-connection-concepts
  2. [2]support.fortanix.comcriteria 4https://support.fortanix.com/docs/fortanix-key-insight-on-premises-file-system
  3. [3]support.fortanix.comcriteria 5, 6, 13, 14https://support.fortanix.com/docs/fortanix-key-insight-pqc-central-concepts
  4. [4]support.fortanix.comcriteria 10https://support.fortanix.com/docs/26-02-ki-february-26-2026
  5. [5]www.fortanix.comcriteria 11, 19https://www.fortanix.com/company/pr/2025/06/fortanix-announces-pqc-central-to-accelerate-post-quantum-readiness
  6. [6]www.fortanix.comcriteria 12, 15, 24, 25, 30https://www.fortanix.com/solutions/use-case/post-quantum-readiness
  7. [7]support.fortanix.comcriteria 18https://support.fortanix.com/docs/fortanix-key-insight
  8. [8]fortanix.comcriteria 21https://fortanix.com/blog/simplifying-pqc-migration-with-fortanix-key-insight-in-the-post-quantum-era
  9. [9]support.fortanix.comcriteria 22https://support.fortanix.com/docs/dsm-algorithm-support
  10. [10]support.fortanix.comcriteria 23https://support.fortanix.com/docs/24-12-ki-december-11-2024
  11. [11]support.fortanix.comcriteria 28https://support.fortanix.com/docs/users-guide-logging
  12. [12]support.fortanix.comcriteria 31https://support.fortanix.com/docs/fortanix-key-insight-for-on-premises-concepts
  13. [13]support.fortanix.comcriteria 32https://support.fortanix.com/docs/fortanix-armor-identity-and-access-management
  14. [14]support.fortanix.comcriteria 33https://support.fortanix.com/docs/is-fortanix-iso-27001-certified
  15. [15]www.fortanix.comcriteria 34https://www.fortanix.com/company/pr/2024/04/key-insight-to-help-organizations-future-proof-their-data-security

DuoKey

  1. [1]docs.duokey.comcriteria 1, 2, 4, 5, 27https://docs.duokey.com/docs/pqc-scanner/overview#scanning-capabilities
  2. [2]docs.duokey.comcriteria 6https://docs.duokey.com/docs/pqc-scanner/guides/data-sources#quick-reference
  3. [3]docs.duokey.comcriteria 7https://docs.duokey.com/docs/pqc-scanner/guides/cli-reference#dke-scanner-agent-fortinet
  4. [4]docs.duokey.comcriteria 8https://docs.duokey.com/docs/pqc-scanner/guides/cli-reference#dke-scanner-agent-ssh
  5. [5]docs.duokey.comcriteria 10https://docs.duokey.com/docs/pqc-scanner/getting-started#generate-cbom
  6. [6]docs.duokey.comcriteria 11https://docs.duokey.com/docs/pqc-scanner/guides/data-sources#10-azure-devops
  7. [7]docs.duokey.comcriteria 12, 13https://docs.duokey.com/docs/pqc-scanner/overview#introduction
  8. [8]docs.duokey.comcriteria 14https://docs.duokey.com/docs/pqc-scanner/api/risk-scoring#the-qrs-report
  9. [9]docs.duokey.comcriteria 15, 18https://docs.duokey.com/docs/pqc-scanner/overview#compliance-engine
  10. [10]duokey.comcriteria 16, 34https://duokey.com/en/solutions/quantum-readiness-score
  11. [11]duokey.comcriteria 17https://duokey.com/en/solutions/cryptographic-posture-management
  12. [12]docs.duokey.comcriteria 19https://docs.duokey.com/docs/pqc-scanner/migration-planning
  13. [13]docs.duokey.comcriteria 20https://docs.duokey.com/docs/pqc-scanner/migration-planning#from-findings-to-a-plan
  14. [14]docs.duokey.comcriteria 21, 25https://docs.duokey.com/docs/cap-sdk/overview#the-five-pillars
  15. [15]docs.duokey.comcriteria 22https://docs.duokey.com/docs/pki-ssl/overview#core-capabilities
  16. [16]docs.duokey.comcriteria 23https://docs.duokey.com/docs/cap-sdk/policies-and-intents#drift-detection-closing-the-loop
  17. [17]docs.duokey.comcriteria 24https://docs.duokey.com/docs/cap-sdk/policies-and-intents#simulate-a-posture-flip-quantum-readiness-score
  18. [18]docs.duokey.comcriteria 26https://docs.duokey.com/docs/pqc-scanner/getting-started#5-cicd-mode
  19. [19]docs.duokey.comcriteria 28https://docs.duokey.com/docs/openshift-on-prem/security/compliance-audit#siem-integration
  20. [20]docs.duokey.comcriteria 29https://docs.duokey.com/docs/cockpit/mcp#what-is-the-mcp-endpoint
  21. [21]docs.duokey.comcriteria 30https://docs.duokey.com/docs/cockpit/vaults/hsm-agent#deployment-tiers
  22. [22]docs.duokey.comcriteria 31https://docs.duokey.com/docs/openshift-on-prem/container-images#air-gapped-mirror-into-your-own-registry
  23. [23]docs.duokey.comcriteria 32https://docs.duokey.com/docs/cockpit/administration#roles-and-permissions
  24. [24]duokey.comcriteria 33https://duokey.com/en/compliance/iso-27001

Discuss the decisions that matter most to your security programme.

Tell us where control is difficult today. We will help you identify a practical next step.

Book a callSee the platform