Insights that help security teams make better decisions.

Six practical criteria for choosing a Microsoft 365 Double Key Encryption (DKE) provider: rotation with continuity, Graph provisioning, multi-tenant B2B, ABAC, key custody and operations.

Generate a CycloneDX 1.7 Cryptography Bill of Materials (CBOM) with DuoKey Cockpit: filesystem, source-code and domain scans, the CBOM Explorer, and the agentic MCP path.

Enable hybrid post-quantum key exchange (ML-KEM, RFC 9370) on FortiGate IPsec VPNs: FortiOS CLI configuration, testing, and the agentic MCP path with DuoKey.

US federal PQC is no longer inventory-only. EO 14412 and OMB M-26-15 set HVA key establishment by 2030 and signatures by 2031. CNSA 2.0 covers national security systems. Here is who is in scope and what to do first.

The UAE has no single cryptography law either, but a more prescriptive, sector-specific landscape than the EU or UK: NESA's IAS, DESC's ISR v2, CBUAE's brand-new Regulation C 1/2026, the PDPL, and a real national post-quantum migration program launched in 2026.

Switzerland has no single PQC statute. NCSC's technology briefs say start now; FINMA Guidance 05/2026 expects a board-backed roadmap by mid-2027, with inventory, crypto-agility and harvest-now-decrypt-later prioritisation.

What Commission Implementing Regulation (EU) 2024/2690 actually requires for cryptography and crypto-agility under NIS2, who it applies to, and what it leaves to member states.

BSI TR-02102-1 version 2026-01 names migration dates: classical-only key agreement ends 2031, high-protection systems by 2030, signatures by 2035. Here is who is in scope under BSIG and what to do first.

What DORA Articles 9-13 and the RTS on ICT risk management actually require for encryption, key management and crypto-agility, with a concrete technical checklist.