DuoKey

Cryptographic Posture Management

DuoKey vs SandboxAQ

SandboxAQ sells AQtive Guard, a cryptographic posture management platform delivered as SaaS on AWS, with local sensors for file systems, network traffic and Java runtimes. DuoKey CPM is a Swiss cryptographic posture platform: discovery across code, cloud KMS, HSMs, appliances and TLS, a CycloneDX CBOM, a readiness score and a migration roadmap, hosted by DuoKey or on your premises.

DuoKey

26 / 34

SandboxAQ

9 / 34

Compared capabilities supported, based on public documentation.

Book a call→See the comparison

Only DuoKey

  • Source code (SAST)
  • Cloud KMS
  • HSM key inventory
  • SSH
  • CycloneDX CBOM export
  • ITSM/CMDB sync and ticketing (ServiceNow, Jira, Azure DevOps)
  • Organisation-level readiness score (single KPI)
  • Dashboards and executive/board reporting
  • Custom/internal crypto policy import
  • Migration roadmap from findings
  • Hybrid PQC rollout guidance
  • Issue PQC (ML-DSA/hybrid) certificates and deploy/rollback them
  • Central crypto policy enforcement and drift detection
  • Vendor-neutral key custody for PQC keys (HSM/MPC/KMS integration)
  • CI/CD gating (SARIF, fail on severity)
  • SaaS and on-premises options
  • Fine-grained RBAC
  • Free self-service assessment or trial

Feature by feature

DuoKey and SandboxAQ, side by side

CapabilityDuoKeySandboxAQ

Discovery

1Network/TLS and PQ key exchange

Scan endpoints, certificate chains, cipher suites and hybrid/PQ key exchange

YesLive PQ key-exchange probeSource
YesTLS suites, certs, hybrid/PQC groupsSource

2Source code (SAST)

Find cryptographic API use in code repositories

YesGitHub, GitLab, Azure DevOps connectorsSource
PartialGitLab CI scanner, scope unstatedSource

3Binaries / compiled artefacts

Crypto in executables, libraries, firmware

Not documentedNo binary analysis documented
YesBinaries listed as scan surface (marketing)Source

4Certificates and keystores

Filesystem keystores and OS certificate stores

YesPEM, DER, PKCS#12, JKS, Windows storeSource
YesKeystores inventoried, not their contentsSource

5Cloud KMS

AWS / Azure / GCP key inventory

YesAWS production; Azure and GCP betaSource
PartialAWS only; no Azure/GCP KMSSource

6HSM key inventory

Keys held in HSMs

YesSecurosys and DuoKey KMSSource
Not documented

7Firewalls, VPN/IPsec, load balancers

Appliance crypto configuration (FortiGate, F5, Palo Alto...)

PartialFortiGate; F5 plannedSource
PartialPalo Alto NGFW TLS logs onlySource

8SSH

Host and user keys

Yesssh-agent, ~/.ssh, host keysSource
PartialSSH key files on disk onlySource

9Databases and non-HTTP TLS

Postgres, MySQL, LDAP, SMTP transport TLS

Not documentedNot in public docs
Not documented

CBOM and inventory

10CycloneDX CBOM export

YesCycloneDX 1.7Source
PartialCycloneDX import; export CSV onlySource

11ITSM/CMDB sync and ticketing (ServiceNow, Jira, Azure DevOps)

YesServiceNow Store app, Azure DevOps work itemsSource
PartialServiceNow certificate ingestion onlySource

Risk

12Per-asset risk score and prioritisation

Yes0-10 score, P0-P4 prioritiesSource
YesRisk and blast radius (marketing)Source

13Organisation-level readiness score (single KPI)

YesReadiness score 0-100 incl. HNDLSource
Not documentedNo single readiness score in docsSource

14Dashboards and executive/board reporting

YesDashboard and branded PDF reportSource
PartialDashboards; exec reporting marketing onlySource

Regulatory

15NIST / CNSA 2.0 mapping

YesSP 800-131A, CNSA 2.0Source
YesNIST profile, CNSA 2.0Source

16BSI / ANSSI / NCSC mapping

PartialBSI in docs; ANSSI, NCSC on websiteSource
Not documented

17FINMA / DORA / NIS2 mapping

PartialStated on website, not in docsSource
Not documented

18Custom/internal crypto policy import

YesCustom PDF-based policiesSource
PartialCustom profiles from built-in rulesSource

Remediation and migration

19Migration roadmap from findings

YesMigration tab in CockpitSource
PartialMigration planning claimed onlySource

20Hybrid PQC rollout guidance

YesHybrid-first with fallbackSource
Not documented

21Automated remediation (drafted fixes / pull requests, human-approved)

PartialAgentic PRs via CAP SDKSource
PartialAutomated rotation; no fix PRsSource

22Issue PQC (ML-DSA/hybrid) certificates and deploy/rollback them

YesML-DSA/composite certs, F5/FortiGate rollbackSource
PartialACME cert rotation; PQC/rollback unstatedSource

Crypto-agility

23Central crypto policy enforcement and drift detection

YesPolicies and drift via CAP SDKSource
PartialBlocks deprecated algorithmsSource

24Policy-change simulation (what-if)

YesSimulate posture change, score upliftSource
YesImpact Assessment simulates TLS changesSource

25Vendor-neutral key custody for PQC keys (HSM/MPC/KMS integration)

YesHSM or optional MPC vault backendsSource
PartialPKCS#11 offload, AWS/Vault storageSource

Integration

26CI/CD gating (SARIF, fail on severity)

YesSARIF, fail-on-severitySource
PartialGitLab MR comments; no gating statedSource

27Both agent-based and agentless discovery

YesHost agent plus agentless network/APIsSource
YesLocal sensors plus agentless AWS roleSource

28SIEM export

PartialPlatform-level SIEM forwardingSource
Not documentedCSV export onlySource

29AI-agent / MCP access

YesCockpit MCP endpointSource
YesAQG MCP serverSource

Deployment and trust

30SaaS and on-premises options

YesDuoKey-hosted or on-premisesSource
PartialCurrent product SaaS onlySource

31Air-gapped deployment

PartialImage mirroring; full air-gap plannedSource
Not documented

32Fine-grained RBAC

YesRole-based permissionsSource
PartialThree fixed rolesSource

33Vendor ISO/IEC 27001 (or SOC 2) certification

YesISO 27001, SOC 2, TISAX AL3Source
YesISO 27001, SOC 2 Type I, FedRAMP ReadySource

34Free self-service assessment or trial

YesFree public-signal Quantum Risk ScoreSource
Not documentedDemo only; AWS listing $250k / 12 monthsSource

Why teams choose DuoKey

Key differences with SandboxAQ

01

Discovery beyond AWS

AQtive Guard's documented cloud source is AWS (KMS, ACM, Secrets Manager). DuoKey CPM inventories AWS, Azure and GCP KMS, HSM keys from Securosys and DuoKey, FortiGate appliances, SSH keys and code repositories on GitHub, GitLab and Azure DevOps.

02

A CBOM you can take with you

AQtive Guard imports CycloneDX CBOMs, and its export documentation lists CSV. DuoKey CPM exports a CycloneDX 1.7 Cryptography Bill of Materials and gates CI pipelines with SARIF and fail-on-severity thresholds.

03

European regulations, not only US ones

AQtive Guard's documented profiles are NIST and CNSA 2.0. DuoKey maps findings to NIST and CNSA 2.0 as well as BSI, and adds a migration roadmap with hybrid-first guidance.

04

Start for free

AQtive Guard is sold through sales or as an AWS Marketplace Enterprise contract listed at USD 250,000 for 12 months. DuoKey offers a free Quantum Risk Score from public signals, with no access to internal systems.

What SandboxAQ does well

AQtive Guard has deep TLS traffic analysis (live or PCAP, including hybrid and PQC groups), many data-source integrations such as CrowdStrike, Qualys and Palo Alto, an Impact Assessment that simulates TLS changes, an MCP server, and ISO 27001, SOC 2 Type I and FedRAMP Ready credentials.

FAQ

Is DuoKey CPM an alternative to SandboxAQ AQtive Guard?

Yes. DuoKey CPM discovers the cryptography in your estate, produces a CycloneDX CBOM, scores post-quantum risk and turns findings into a migration roadmap, hosted by DuoKey or on your premises.

Can I try DuoKey without installing anything?

Yes. The free Quantum Risk Score is computed from public signals, with no access to your internal systems.

How were these criteria chosen?

They follow a buyer's questions for cryptographic posture management: discovery sources, CBOM, risk, regulation, migration, crypto-agility, integration and deployment. Every cell links to the public document it is based on.

Evidence

Every claim on this page, sourced

SandboxAQ

  1. [1]docs.aqtiveguard.comcriteria 1https://docs.aqtiveguard.com/data-sources/aqg-network-analyzer/reference/
  2. [2]docs.aqtiveguard.comcriteria 2, 26https://docs.aqtiveguard.com/data-sources/gitlab/
  3. [3]www.aqtiveguard.comcriteria 3, 21, 23https://www.aqtiveguard.com/platform
  4. [4]docs.aqtiveguard.comcriteria 4, 8https://docs.aqtiveguard.com/data-sources/aqg-filesystem-scanner/supported-formats/
  5. [5]docs.aqtiveguard.comcriteria 5, 27https://docs.aqtiveguard.com/data-sources/aws/
  6. [6]docs.aqtiveguard.comcriteria 7https://docs.aqtiveguard.com/data-sources/
  7. [7]docs.aqtiveguard.comcriteria 10https://docs.aqtiveguard.com/data-sources/cbom/
  8. [8]docs.aqtiveguard.comcriteria 11https://docs.aqtiveguard.com/data-sources/servicenow/
  9. [9]www.aqtiveguard.comcriteria 12, 14https://www.aqtiveguard.com/
  10. [10]docs.aqtiveguard.comcriteria 13https://docs.aqtiveguard.com/dashboard/
  11. [11]docs.aqtiveguard.comcriteria 15, 18https://docs.aqtiveguard.com/profiles/
  12. [12]www.sandboxaq.comcriteria 19, 33https://www.sandboxaq.com/press/sandboxaq-achieves-fedramp-ready-status-powering-enterprise-readiness-across-the-defense-and-public-sector
  13. [13]docs.aqtiveguard.comcriteria 22, 25https://docs.aqtiveguard.com/aqg-protect/
  14. [14]docs.aqtiveguard.comcriteria 24https://docs.aqtiveguard.com/impact-assessment/
  15. [15]docs.aqtiveguard.comcriteria 28https://docs.aqtiveguard.com/exports/
  16. [16]docs.aqtiveguard.comcriteria 29https://docs.aqtiveguard.com/aqg-mcp/
  17. [17]aqtiveguard.sandboxaq.comcriteria 30https://aqtiveguard.sandboxaq.com/docs/
  18. [18]docs.aqtiveguard.comcriteria 32https://docs.aqtiveguard.com/login-and-user-roles/
  19. [19]aws.amazon.comcriteria 34https://aws.amazon.com/marketplace/pp/prodview-ccwrhqfeekqwk

DuoKey

  1. [1]docs.duokey.comcriteria 1, 2, 4, 5, 27https://docs.duokey.com/docs/pqc-scanner/overview#scanning-capabilities
  2. [2]docs.duokey.comcriteria 6https://docs.duokey.com/docs/pqc-scanner/guides/data-sources#quick-reference
  3. [3]docs.duokey.comcriteria 7https://docs.duokey.com/docs/pqc-scanner/guides/cli-reference#dke-scanner-agent-fortinet
  4. [4]docs.duokey.comcriteria 8https://docs.duokey.com/docs/pqc-scanner/guides/cli-reference#dke-scanner-agent-ssh
  5. [5]docs.duokey.comcriteria 10https://docs.duokey.com/docs/pqc-scanner/getting-started#generate-cbom
  6. [6]docs.duokey.comcriteria 11https://docs.duokey.com/docs/pqc-scanner/guides/data-sources#10-azure-devops
  7. [7]docs.duokey.comcriteria 12, 13https://docs.duokey.com/docs/pqc-scanner/overview#introduction
  8. [8]docs.duokey.comcriteria 14https://docs.duokey.com/docs/pqc-scanner/api/risk-scoring#the-qrs-report
  9. [9]docs.duokey.comcriteria 15, 18https://docs.duokey.com/docs/pqc-scanner/overview#compliance-engine
  10. [10]duokey.comcriteria 16, 34https://duokey.com/en/solutions/quantum-readiness-score
  11. [11]duokey.comcriteria 17https://duokey.com/en/solutions/cryptographic-posture-management
  12. [12]docs.duokey.comcriteria 19https://docs.duokey.com/docs/pqc-scanner/migration-planning
  13. [13]docs.duokey.comcriteria 20https://docs.duokey.com/docs/pqc-scanner/migration-planning#from-findings-to-a-plan
  14. [14]docs.duokey.comcriteria 21, 25https://docs.duokey.com/docs/cap-sdk/overview#the-five-pillars
  15. [15]docs.duokey.comcriteria 22https://docs.duokey.com/docs/pki-ssl/overview#core-capabilities
  16. [16]docs.duokey.comcriteria 23https://docs.duokey.com/docs/cap-sdk/policies-and-intents#drift-detection-closing-the-loop
  17. [17]docs.duokey.comcriteria 24https://docs.duokey.com/docs/cap-sdk/policies-and-intents#simulate-a-posture-flip-quantum-readiness-score
  18. [18]docs.duokey.comcriteria 26https://docs.duokey.com/docs/pqc-scanner/getting-started#5-cicd-mode
  19. [19]docs.duokey.comcriteria 28https://docs.duokey.com/docs/openshift-on-prem/security/compliance-audit#siem-integration
  20. [20]docs.duokey.comcriteria 29https://docs.duokey.com/docs/cockpit/mcp#what-is-the-mcp-endpoint
  21. [21]docs.duokey.comcriteria 30https://docs.duokey.com/docs/cockpit/vaults/hsm-agent#deployment-tiers
  22. [22]docs.duokey.comcriteria 31https://docs.duokey.com/docs/openshift-on-prem/container-images#air-gapped-mirror-into-your-own-registry
  23. [23]docs.duokey.comcriteria 32https://docs.duokey.com/docs/cockpit/administration#roles-and-permissions
  24. [24]duokey.comcriteria 33https://duokey.com/en/compliance/iso-27001

Discuss the decisions that matter most to your security programme.

Tell us where control is difficult today. We will help you identify a practical next step.

Book a callSee the platform