DuoKey

Cryptographic Posture Management

DuoKey vs IBM

IBM sells Guardium Cryptography Manager, built on Guardium Quantum Safe, with Quantum Safe Explorer for code and Quantum Safe Remediator for hybrid TLS proxies. It is self-managed on OpenShift or Kubernetes. DuoKey CPM is a Swiss cryptographic posture platform: discovery across code, cloud KMS, HSMs, appliances and TLS, a CycloneDX CBOM, a readiness score and a migration roadmap, hosted by DuoKey or on your premises.

DuoKey

26 / 34

IBM

12 / 34

Compared capabilities supported, based on public documentation.

Book a call→See the comparison

Only DuoKey

  • Network/TLS and PQ key exchange
  • Certificates and keystores
  • Cloud KMS
  • HSM key inventory
  • SSH
  • NIST / CNSA 2.0 mapping
  • Migration roadmap from findings
  • Issue PQC (ML-DSA/hybrid) certificates and deploy/rollback them
  • Central crypto policy enforcement and drift detection
  • Policy-change simulation (what-if)
  • Vendor-neutral key custody for PQC keys (HSM/MPC/KMS integration)
  • CI/CD gating (SARIF, fail on severity)
  • Both agent-based and agentless discovery
  • SaaS and on-premises options
  • Vendor ISO/IEC 27001 (or SOC 2) certification

Feature by feature

DuoKey and IBM, side by side

CapabilityDuoKeyIBM

Discovery

1Network/TLS and PQ key exchange

Scan endpoints, certificate chains, cipher suites and hybrid/PQ key exchange

YesLive PQ key-exchange probeSource
PartialNetwork scans, Qualys/Nmap importSource

2Source code (SAST)

Find cryptographic API use in code repositories

YesGitHub, GitLab, Azure DevOps connectorsSource
YesQuantum Safe Explorer: Java, C/C++, C#, Python, GoSource

3Binaries / compiled artefacts

Crypto in executables, libraries, firmware

Not documentedNo binary analysis documented
Not documented

4Certificates and keystores

Filesystem keystores and OS certificate stores

YesPEM, DER, PKCS#12, JKS, Windows storeSource
PartialCertificates via network, K8s, VaultSource

5Cloud KMS

AWS / Azure / GCP key inventory

YesAWS production; Azure and GCP betaSource
PartialAWS discovery; Azure/GCP KMS not namedSource

6HSM key inventory

Keys held in HSMs

YesSecurosys and DuoKey KMSSource
Not documented

7Firewalls, VPN/IPsec, load balancers

Appliance crypto configuration (FortiGate, F5, Palo Alto...)

PartialFortiGate; F5 plannedSource
Not documented

8SSH

Host and user keys

Yesssh-agent, ~/.ssh, host keysSource
PartialSSH protocol and host key typesSource

9Databases and non-HTTP TLS

Postgres, MySQL, LDAP, SMTP transport TLS

Not documentedNot in public docs
PartialDatabase encryption (TDE) statusSource

CBOM and inventory

10CycloneDX CBOM export

YesCycloneDX 1.7Source
YesCycloneDX 1.6Source

11ITSM/CMDB sync and ticketing (ServiceNow, Jira, Azure DevOps)

YesServiceNow Store app, Azure DevOps work itemsSource
YesServiceNow, Jira tickets, CMDBSource

Risk

12Per-asset risk score and prioritisation

Yes0-10 score, P0-P4 prioritiesSource
YesPer-asset exploitability scoreSource

13Organisation-level readiness score (single KPI)

YesReadiness score 0-100 incl. HNDLSource
YesEnterprise risk score, readiness KPISource

14Dashboards and executive/board reporting

YesDashboard and branded PDF reportSource
YesPersona-based dashboardsSource

Regulatory

15NIST / CNSA 2.0 mapping

YesSP 800-131A, CNSA 2.0Source
PartialNIST controls, FIPS 140-3; CNSA 2.0 not foundSource

16BSI / ANSSI / NCSC mapping

PartialBSI in docs; ANSSI, NCSC on websiteSource
Not documented

17FINMA / DORA / NIS2 mapping

PartialStated on website, not in docsSource
Not documented

18Custom/internal crypto policy import

YesCustom PDF-based policiesSource
YesCustom policies and frameworksSource

Remediation and migration

19Migration roadmap from findings

YesMigration tab in CockpitSource
PartialRoadmap via consulting servicesSource

20Hybrid PQC rollout guidance

YesHybrid-first with fallbackSource
YesRemediator hybrid PQC proxySource

21Automated remediation (drafted fixes / pull requests, human-approved)

PartialAgentic PRs via CAP SDKSource
PartialRemediation workflows; no code PRsSource

22Issue PQC (ML-DSA/hybrid) certificates and deploy/rollback them

YesML-DSA/composite certs, F5/FortiGate rollbackSource
PartialCLM renew via Venafi/Vault; PQC not statedSource

Crypto-agility

23Central crypto policy enforcement and drift detection

YesPolicies and drift via CAP SDKSource
PartialPolicy violations; drift not explicitSource

24Policy-change simulation (what-if)

YesSimulate posture change, score upliftSource
Not documentedAlgorithm benchmarking only

25Vendor-neutral key custody for PQC keys (HSM/MPC/KMS integration)

YesHSM or optional MPC vault backendsSource
PartialKMIP, Vault, GKLM; no MPCSource

Integration

26CI/CD gating (SARIF, fail on severity)

YesSARIF, fail-on-severitySource
Not documented

27Both agent-based and agentless discovery

YesHost agent plus agentless network/APIsSource
PartialAgentless scans; no agent statedSource

28SIEM export

PartialPlatform-level SIEM forwardingSource
Not documented

29AI-agent / MCP access

YesCockpit MCP endpointSource
YesGCM MCP serverSource

Deployment and trust

30SaaS and on-premises options

YesDuoKey-hosted or on-premisesSource
PartialSelf-managed only; no SaaS foundSource

31Air-gapped deployment

PartialImage mirroring; full air-gap plannedSource
YesAir-gapped install with image mirroringSource

32Fine-grained RBAC

YesRole-based permissionsSource
YesCustom roles, fine-grained and ABACSource

33Vendor ISO/IEC 27001 (or SOC 2) certification

YesISO 27001, SOC 2, TISAX AL3Source
Not documentedSelf-hosted software

34Free self-service assessment or trial

YesFree public-signal Quantum Risk ScoreSource
Yes90-day trial on AWS MarketplaceSource

Why teams choose DuoKey

Key differences with IBM

01

Hosted or self-hosted

Guardium Cryptography Manager is self-managed on OpenShift or Kubernetes, with no SaaS edition found. DuoKey CPM runs DuoKey-hosted or on your premises.

02

Discovery across clouds and appliances

IBM documents network, Kubernetes, AWS, SSH and Vault discovery. DuoKey CPM also inventories Azure and GCP KMS, HSM keys, FortiGate appliances and Windows certificate stores.

03

Fixes in your pipelines

IBM remediates through tickets, workflows and a hybrid TLS proxy. DuoKey CPM gates CI with SARIF and can draft remediation pull requests through its agent SDK.

04

A free start with no install

IBM's free option is a 90-day trial you deploy yourself on AWS. DuoKey's Quantum Risk Score is computed from public signals with nothing to install.

What IBM does well

IBM co-authored the CBOM standard in CycloneDX 1.6, offers a broad self-hosted platform with risk scoring, persona dashboards and an MCP server, supports air-gapped installation and fine-grained access control, and its Remediator proxies add hybrid post-quantum TLS in front of legacy applications without code changes.

FAQ

Is DuoKey CPM an alternative to IBM Guardium Cryptography Manager (Quantum Safe)?

Yes. DuoKey CPM discovers the cryptography in your estate, produces a CycloneDX CBOM, scores post-quantum risk and turns findings into a migration roadmap, hosted by DuoKey or on your premises.

Can I try DuoKey without installing anything?

Yes. The free Quantum Risk Score is computed from public signals, with no access to your internal systems.

How were these criteria chosen?

They follow a buyer's questions for cryptographic posture management: discovery sources, CBOM, risk, regulation, migration, crypto-agility, integration and deployment. Every cell links to the public document it is based on.

Evidence

Every claim on this page, sourced

IBM

  1. [1]www.ibm.comcriteria 1, 12, 13, 22, 25https://www.ibm.com/docs/en/guardium-cm/2.0.0?topic=new-whats-in-guardium-cryptography-manager-2000
  2. [2]www.ibm.comcriteria 2https://www.ibm.com/downloads/documents/fr-fr/137a1e22185bac92
  3. [3]www.ibm.comcriteria 4, 10, 31https://www.ibm.com/docs/en/guardium-cm/2.0.x?topic=new-whats-in-guardium-cryptography-manager-2030
  4. [4]www.ibm.comcriteria 5, 8, 14https://www.ibm.com/docs/en/guardium-cm/2.0.x?topic=new-whats-in-guardium-cryptography-manager-2020
  5. [5]www.ibm.comcriteria 9, 27https://www.ibm.com/new/announcements/control-of-cryptographic-risk-in-the-quantum-era-introducing-ibm-guardium-cryptography-manager
  6. [6]www.ibm.comcriteria 11https://www.ibm.com/docs/en/gdsc/3.x?topic=safe-quick-start-guide
  7. [7]www.ibm.comcriteria 15https://www.ibm.com/docs/en/guardium-cm/1.0.0?topic=violations-types-policy-in-guardium-cryptography-manager
  8. [8]www.ibm.comcriteria 18, 29, 32https://www.ibm.com/docs/en/guardium-cm/2.0.0?topic=new-whats-in-guardium-cryptography-manager-201
  9. [9]www.ibm.comcriteria 19https://www.ibm.com/quantum/quantum-safe
  10. [10]www.ibm.comcriteria 20https://www.ibm.com/downloads/documents/fr-fr/137a1e2217dbac55
  11. [11]aws.amazon.comcriteria 21https://aws.amazon.com/marketplace/pp/prodview-cmfoy37adnxga
  12. [12]www.ibm.comcriteria 23https://www.ibm.com/products/guardium-cryptography-manager
  13. [13]www.ibm.comcriteria 30https://www.ibm.com/docs/en/guardium-cm/2.0.0?topic=system-requirements-prerequisites
  14. [14]aws.amazon.comcriteria 34https://aws.amazon.com/blogs/ibm-redhat/ibm-guardium-cryptography-manager-is-now-on-aws-marketplace/

DuoKey

  1. [1]docs.duokey.comcriteria 1, 2, 4, 5, 27https://docs.duokey.com/docs/pqc-scanner/overview#scanning-capabilities
  2. [2]docs.duokey.comcriteria 6https://docs.duokey.com/docs/pqc-scanner/guides/data-sources#quick-reference
  3. [3]docs.duokey.comcriteria 7https://docs.duokey.com/docs/pqc-scanner/guides/cli-reference#dke-scanner-agent-fortinet
  4. [4]docs.duokey.comcriteria 8https://docs.duokey.com/docs/pqc-scanner/guides/cli-reference#dke-scanner-agent-ssh
  5. [5]docs.duokey.comcriteria 10https://docs.duokey.com/docs/pqc-scanner/getting-started#generate-cbom
  6. [6]docs.duokey.comcriteria 11https://docs.duokey.com/docs/pqc-scanner/guides/data-sources#10-azure-devops
  7. [7]docs.duokey.comcriteria 12, 13https://docs.duokey.com/docs/pqc-scanner/overview#introduction
  8. [8]docs.duokey.comcriteria 14https://docs.duokey.com/docs/pqc-scanner/api/risk-scoring#the-qrs-report
  9. [9]docs.duokey.comcriteria 15, 18https://docs.duokey.com/docs/pqc-scanner/overview#compliance-engine
  10. [10]duokey.comcriteria 16, 34https://duokey.com/en/solutions/quantum-readiness-score
  11. [11]duokey.comcriteria 17https://duokey.com/en/solutions/cryptographic-posture-management
  12. [12]docs.duokey.comcriteria 19https://docs.duokey.com/docs/pqc-scanner/migration-planning
  13. [13]docs.duokey.comcriteria 20https://docs.duokey.com/docs/pqc-scanner/migration-planning#from-findings-to-a-plan
  14. [14]docs.duokey.comcriteria 21, 25https://docs.duokey.com/docs/cap-sdk/overview#the-five-pillars
  15. [15]docs.duokey.comcriteria 22https://docs.duokey.com/docs/pki-ssl/overview#core-capabilities
  16. [16]docs.duokey.comcriteria 23https://docs.duokey.com/docs/cap-sdk/policies-and-intents#drift-detection-closing-the-loop
  17. [17]docs.duokey.comcriteria 24https://docs.duokey.com/docs/cap-sdk/policies-and-intents#simulate-a-posture-flip-quantum-readiness-score
  18. [18]docs.duokey.comcriteria 26https://docs.duokey.com/docs/pqc-scanner/getting-started#5-cicd-mode
  19. [19]docs.duokey.comcriteria 28https://docs.duokey.com/docs/openshift-on-prem/security/compliance-audit#siem-integration
  20. [20]docs.duokey.comcriteria 29https://docs.duokey.com/docs/cockpit/mcp#what-is-the-mcp-endpoint
  21. [21]docs.duokey.comcriteria 30https://docs.duokey.com/docs/cockpit/vaults/hsm-agent#deployment-tiers
  22. [22]docs.duokey.comcriteria 31https://docs.duokey.com/docs/openshift-on-prem/container-images#air-gapped-mirror-into-your-own-registry
  23. [23]docs.duokey.comcriteria 32https://docs.duokey.com/docs/cockpit/administration#roles-and-permissions
  24. [24]duokey.comcriteria 33https://duokey.com/en/compliance/iso-27001

Discuss the decisions that matter most to your security programme.

Tell us where control is difficult today. We will help you identify a practical next step.

Book a callSee the platform