DuoKey

Cryptographic Posture Management

DuoKey vs Keyfactor

Keyfactor sells AgileSec, the cryptographic discovery and analytics platform it acquired with InfoSec Global in 2025, on premises or as SaaS, alongside Keyfactor Command and EJBCA for certificates. DuoKey CPM is a Swiss cryptographic posture platform: discovery across code, cloud KMS, HSMs, appliances and TLS, a CycloneDX CBOM, a readiness score and a migration roadmap, hosted by DuoKey or on your premises.

DuoKey

26 / 34

Keyfactor

16 / 34

Compared capabilities supported, based on public documentation.

Book a call→See the comparison

Only DuoKey

  • Network/TLS and PQ key exchange
  • CycloneDX CBOM export
  • Organisation-level readiness score (single KPI)
  • Issue PQC (ML-DSA/hybrid) certificates and deploy/rollback them
  • Central crypto policy enforcement and drift detection
  • Policy-change simulation (what-if)
  • Vendor-neutral key custody for PQC keys (HSM/MPC/KMS integration)
  • CI/CD gating (SARIF, fail on severity)
  • Both agent-based and agentless discovery
  • AI-agent / MCP access
  • Free self-service assessment or trial

Feature by feature

DuoKey and Keyfactor, side by side

CapabilityDuoKeyKeyfactor

Discovery

1Network/TLS and PQ key exchange

Scan endpoints, certificate chains, cipher suites and hybrid/PQ key exchange

YesLive PQ key-exchange probeSource
PartialTLS/SSH via CipherInsights; PQ KEX not statedSource

2Source code (SAST)

Find cryptographic API use in code repositories

YesGitHub, GitLab, Azure DevOps connectorsSource
YesGit, GitHub, GitLab, Bitbucket sensorsSource

3Binaries / compiled artefacts

Crypto in executables, libraries, firmware

Not documentedNo binary analysis documented
YesBinary scan incl. JAR/WAR/EARSource

4Certificates and keystores

Filesystem keystores and OS certificate stores

YesPEM, DER, PKCS#12, JKS, Windows storeSource
YesJava/PKCS keystores, OS stores (datasheet)Source

5Cloud KMS

AWS / Azure / GCP key inventory

YesAWS production; Azure and GCP betaSource
YesAWS KMS, Azure Key Vault, GCP KMSSource

6HSM key inventory

Keys held in HSMs

YesSecurosys and DuoKey KMSSource
YesPKCS#11, Thales Luna, Thales CTMSource

7Firewalls, VPN/IPsec, load balancers

Appliance crypto configuration (FortiGate, F5, Palo Alto...)

PartialFortiGate; F5 plannedSource
Not documentedOnly Qualys/Tenable importsSource

8SSH

Host and user keys

Yesssh-agent, ~/.ssh, host keysSource
YesSSH keys and algorithmsSource

9Databases and non-HTTP TLS

Postgres, MySQL, LDAP, SMTP transport TLS

Not documentedNot in public docs
PartialMSSQL connector onlySource

CBOM and inventory

10CycloneDX CBOM export

YesCycloneDX 1.7Source
PartialCBOM exporter; format not statedSource

11ITSM/CMDB sync and ticketing (ServiceNow, Jira, Azure DevOps)

YesServiceNow Store app, Azure DevOps work itemsSource
YesServiceNow VR integrationSource

Risk

12Per-asset risk score and prioritisation

Yes0-10 score, P0-P4 prioritiesSource
YesPer-object cryptographic scoreSource

13Organisation-level readiness score (single KPI)

YesReadiness score 0-100 incl. HNDLSource
PartialPosture progression; no single KPISource

14Dashboards and executive/board reporting

YesDashboard and branded PDF reportSource
YesCustomizable dashboards and reportsSource

Regulatory

15NIST / CNSA 2.0 mapping

YesSP 800-131A, CNSA 2.0Source
YesNIST on product pageSource

16BSI / ANSSI / NCSC mapping

PartialBSI in docs; ANSSI, NCSC on websiteSource
Not documented

17FINMA / DORA / NIS2 mapping

PartialStated on website, not in docsSource
PartialDORA in a blog; FINMA, NIS2 not foundSource

18Custom/internal crypto policy import

YesCustom PDF-based policiesSource
YesCustomizable risk policiesSource

Remediation and migration

19Migration roadmap from findings

YesMigration tab in CockpitSource
YesPQC migration plans (datasheet)Source

20Hybrid PQC rollout guidance

YesHybrid-first with fallbackSource
YesEJBCA hybrid PQC PKI tutorialSource

21Automated remediation (drafted fixes / pull requests, human-approved)

PartialAgentic PRs via CAP SDKSource
PartialWorkflow/ITSM remediation; no code PRsSource

22Issue PQC (ML-DSA/hybrid) certificates and deploy/rollback them

YesML-DSA/composite certs, F5/FortiGate rollbackSource
PartialEJBCA ML-DSA/hybrid certs; deploy not shownSource

Crypto-agility

23Central crypto policy enforcement and drift detection

YesPolicies and drift via CAP SDKSource
PartialPolicy engine monitoring; enforce via workflowsSource

24Policy-change simulation (what-if)

YesSimulate posture change, score upliftSource
Not documented

25Vendor-neutral key custody for PQC keys (HSM/MPC/KMS integration)

YesHSM or optional MPC vault backendsSource
PartialInventories HSM/KMS keys; no MPCSource

Integration

26CI/CD gating (SARIF, fail on severity)

YesSARIF, fail-on-severitySource
PartialAPI-triggered scans; no SARIF/gatingSource

27Both agent-based and agentless discovery

YesHost agent plus agentless network/APIsSource
PartialEDR host sensors plus API connectorsSource

28SIEM export

PartialPlatform-level SIEM forwardingSource
PartialLog forwarding to customer collectorSource

29AI-agent / MCP access

YesCockpit MCP endpointSource
PartialMCP server for Command only (experimental)Source

Deployment and trust

30SaaS and on-premises options

YesDuoKey-hosted or on-premisesSource
YesOn-prem, SaaS multi-tenant or dedicatedSource

31Air-gapped deployment

PartialImage mirroring; full air-gap plannedSource
PartialRemote CLI for air-gapped assetsSource

32Fine-grained RBAC

YesRole-based permissionsSource
YesFine-grained roles, SAML SSOSource

33Vendor ISO/IEC 27001 (or SOC 2) certification

YesISO 27001, SOC 2, TISAX AL3Source
YesKeyfactor ISO 27001Source

34Free self-service assessment or trial

YesFree public-signal Quantum Risk ScoreSource
PartialNo AgileSec trial; Command trial, PQC LabSource

Why teams choose DuoKey

Key differences with Keyfactor

01

Remediation in the developer workflow

AgileSec remediates through workflows and ServiceNow. DuoKey CPM gates CI pipelines with SARIF and fail-on-severity thresholds and can draft remediation pull requests through its agent SDK.

02

A standard CBOM and a single score

AgileSec's documentation mentions a CBOM exporter without naming the format, and tracks posture without a single organisation-level score. DuoKey CPM exports CycloneDX 1.7 and computes a 0 to 100 readiness score, including harvest-now-decrypt-later exposure.

03

Network appliances and live PQC checks

No firewall or load-balancer connector is documented for AgileSec. DuoKey CPM reads FortiGate certificates and VPN profiles and probes TLS endpoints for post-quantum key exchange.

04

Simulate before you change

DuoKey simulates a policy change and shows its effect on the readiness score before rollout. No what-if simulation is documented for AgileSec.

What Keyfactor does well

AgileSec has the broadest discovery of this group: source code, binaries, containers, Artifactory, AWS, Azure and GCP KMS, HSMs through PKCS#11, Luna and CipherTrust, and hosts through CrowdStrike and Tanium. It runs on premises or as SaaS, and connects to Keyfactor Command and EJBCA for post-quantum certificates.

FAQ

Is DuoKey CPM an alternative to Keyfactor AgileSec (formerly InfoSec Global)?

Yes. DuoKey CPM discovers the cryptography in your estate, produces a CycloneDX CBOM, scores post-quantum risk and turns findings into a migration roadmap, hosted by DuoKey or on your premises.

Can I try DuoKey without installing anything?

Yes. The free Quantum Risk Score is computed from public signals, with no access to your internal systems.

How were these criteria chosen?

They follow a buyer's questions for cryptographic posture management: discovery sources, CBOM, risk, regulation, migration, crypto-agility, integration and deployment. Every cell links to the public document it is based on.

Evidence

Every claim on this page, sourced

Keyfactor

  1. [1]docs.keyfactor.comcriteria 1https://docs.keyfactor.com/agilesec/latest/cipher-insights-sensor-user-guide
  2. [2]docs.keyfactor.comcriteria 2https://docs.keyfactor.com/agilesec/latest/github-sensor-user-guide
  3. [3]docs.keyfactor.comcriteria 3, 26https://docs.keyfactor.com/agilesec/3.4/sensors-architecture-and-overview
  4. [4]marketplace.crowdstrike.comcriteria 4, 6, 8, 12, 13, 19, 23https://marketplace.crowdstrike.com/content/dam/crowdstrike/marketplace/en-us/documents/InfoSec_Global__ISG__AgileSec_Analytics_Brochure.pdf
  5. [5]docs.keyfactor.comcriteria 5, 9https://docs.keyfactor.com/agilesec/latest/modules
  6. [6]docs.keyfactor.comcriteria 7https://docs.keyfactor.com/agilesec/latest/connectors
  7. [7]docs.keyfactor.comcriteria 10https://docs.keyfactor.com/agilesec/latest/agilesec-3-6-release-notes
  8. [8]docs.keyfactor.comcriteria 11https://docs.keyfactor.com/agilesec/latest/integrations
  9. [9]www.keyfactor.comcriteria 14, 15, 18, 21https://www.keyfactor.com/products/cryptographic-discovery-inventory/
  10. [10]www.keyfactor.comcriteria 17https://www.keyfactor.com/blog/dora-cryptography-and-pki-what-eu-financial-entities-must-prove/
  11. [11]docs.keyfactor.comcriteria 20https://docs.keyfactor.com/ejbca/9.3.2/tutorial-build-a-post-quantum-ready-pki
  12. [12]www.businesswire.comcriteria 22, 25https://www.businesswire.com/news/home/20250422013160/en
  13. [13]marketplace.crowdstrike.comcriteria 27https://marketplace.crowdstrike.com/listings/infosec-global-agilesec-analytics/
  14. [14]service-catalog.keyfactor.comcriteria 28https://service-catalog.keyfactor.com/service-catalog/latest/agilesec
  15. [15]www.keyfactor.comcriteria 29https://www.keyfactor.com/press-releases/keyfactor-expands-agentic-ai-capabilities-with-command-mcp-server-now-available-in-aws-marketplace/
  16. [16]docs.keyfactor.comcriteria 30, 32https://docs.keyfactor.com/agilesec/latest/agilesec-security-model
  17. [17]docs.keyfactor.comcriteria 31https://docs.keyfactor.com/agilesec/latest/introduction
  18. [18]www.keyfactor.comcriteria 33https://www.keyfactor.com/press-releases/keyfactor-achieves-iso-27001-certification/
  19. [19]www.keyfactor.comcriteria 34https://www.keyfactor.com/keyfactor-for-developers/

DuoKey

  1. [1]docs.duokey.comcriteria 1, 2, 4, 5, 27https://docs.duokey.com/docs/pqc-scanner/overview#scanning-capabilities
  2. [2]docs.duokey.comcriteria 6https://docs.duokey.com/docs/pqc-scanner/guides/data-sources#quick-reference
  3. [3]docs.duokey.comcriteria 7https://docs.duokey.com/docs/pqc-scanner/guides/cli-reference#dke-scanner-agent-fortinet
  4. [4]docs.duokey.comcriteria 8https://docs.duokey.com/docs/pqc-scanner/guides/cli-reference#dke-scanner-agent-ssh
  5. [5]docs.duokey.comcriteria 10https://docs.duokey.com/docs/pqc-scanner/getting-started#generate-cbom
  6. [6]docs.duokey.comcriteria 11https://docs.duokey.com/docs/pqc-scanner/guides/data-sources#10-azure-devops
  7. [7]docs.duokey.comcriteria 12, 13https://docs.duokey.com/docs/pqc-scanner/overview#introduction
  8. [8]docs.duokey.comcriteria 14https://docs.duokey.com/docs/pqc-scanner/api/risk-scoring#the-qrs-report
  9. [9]docs.duokey.comcriteria 15, 18https://docs.duokey.com/docs/pqc-scanner/overview#compliance-engine
  10. [10]duokey.comcriteria 16, 34https://duokey.com/en/solutions/quantum-readiness-score
  11. [11]duokey.comcriteria 17https://duokey.com/en/solutions/cryptographic-posture-management
  12. [12]docs.duokey.comcriteria 19https://docs.duokey.com/docs/pqc-scanner/migration-planning
  13. [13]docs.duokey.comcriteria 20https://docs.duokey.com/docs/pqc-scanner/migration-planning#from-findings-to-a-plan
  14. [14]docs.duokey.comcriteria 21, 25https://docs.duokey.com/docs/cap-sdk/overview#the-five-pillars
  15. [15]docs.duokey.comcriteria 22https://docs.duokey.com/docs/pki-ssl/overview#core-capabilities
  16. [16]docs.duokey.comcriteria 23https://docs.duokey.com/docs/cap-sdk/policies-and-intents#drift-detection-closing-the-loop
  17. [17]docs.duokey.comcriteria 24https://docs.duokey.com/docs/cap-sdk/policies-and-intents#simulate-a-posture-flip-quantum-readiness-score
  18. [18]docs.duokey.comcriteria 26https://docs.duokey.com/docs/pqc-scanner/getting-started#5-cicd-mode
  19. [19]docs.duokey.comcriteria 28https://docs.duokey.com/docs/openshift-on-prem/security/compliance-audit#siem-integration
  20. [20]docs.duokey.comcriteria 29https://docs.duokey.com/docs/cockpit/mcp#what-is-the-mcp-endpoint
  21. [21]docs.duokey.comcriteria 30https://docs.duokey.com/docs/cockpit/vaults/hsm-agent#deployment-tiers
  22. [22]docs.duokey.comcriteria 31https://docs.duokey.com/docs/openshift-on-prem/container-images#air-gapped-mirror-into-your-own-registry
  23. [23]docs.duokey.comcriteria 32https://docs.duokey.com/docs/cockpit/administration#roles-and-permissions
  24. [24]duokey.comcriteria 33https://duokey.com/en/compliance/iso-27001

Discuss the decisions that matter most to your security programme.

Tell us where control is difficult today. We will help you identify a practical next step.

Book a callSee the platform