Insights that help security teams make better decisions.

An AWS KMS custom key store is either a CloudHSM key store or an external key store (XKS). Where the key material sits, who operates it, and when XKS is the one you need.

Service encryption with Customer Key adds your root keys to Microsoft 365 encryption for Exchange, SharePoint, OneDrive, Teams and Windows 365. What Microsoft still holds, and where DuoKey sits.

Double Key Encryption (DKE) protects labelled Microsoft 365 content with two keys. Both are required to open it. What it covers, what it stops, and how DuoKey holds the external key.

How the ACME protocol works with a private CA: RFC 8555 flow, challenges, ACME vs EST vs SCEP vs CMP, and certbot, acme.sh and cert-manager setup with DuoKey.

Certificate lifecycle management explained: CLM stages, machine identity management, certificate discovery, preventing expiry outages and a CLM tool checklist.

How to build a cryptographic inventory: what to record, cryptographic discovery methods compared, certificate discovery, CBOM, prioritisation and a 90-day plan.

Data sovereignty in Switzerland explained: revFADP, FINMA outsourcing, the US CLOUD Act, and why key sovereignty with customer-held keys decides who reads data.

Enterprise key management explained: key lifecycle per NIST SP 800-57, KMS vs HSM vs key management as a service (KMaaS) vs MPC, and a 15-point buyer checklist.

Hold your own key (HYOK) explained: BYOK vs HYOK vs provider-managed keys, how Microsoft 365 DKE, AWS XKS and Google CSE implement it, and how to choose.