Insights that help security teams make better decisions.

Hold your own key (HYOK) explained: BYOK vs HYOK vs provider-managed keys, how Microsoft 365 DKE, AWS XKS and Google CSE implement it, and how to choose.

Compare Microsoft 365 Double Key Encryption providers: DuoKey, Thales, Entrust, Fortanix, Utimaco, Cosmian and IBM. Key protection, deployment, rotation, access control, jurisdiction.

ML-DSA (FIPS 204) explained: parameter sets and sizes, CNSA 2.0 status, ML-DSA certificates (RFC 9881), hybrid certificates and a CA migration path.

ML-KEM (FIPS 203) explained: parameter sets and key sizes, Kyber vs ML-KEM, CNSA 2.0, hybrid TLS and how to generate, store and rotate ML-KEM keys.

PKI as a service explained: how a managed private CA works, providers compared, CA key custody, post-quantum readiness and an AD CS migration plan.

47-day and 100-day TLS certificates: SC-081 dates (200, 100, 47 days), 10-day DCV reuse, renewal math, ACME ARI and a plan before March 2027.

Crypto agility explained: NIST's definition, real examples, a crypto agility policy template, what a crypto agility platform must do, KPIs and maturity.

DKE vs Microsoft 365 Customer Key: who holds each key, what Microsoft can still decrypt, which features stop, and when to use one, the other, or both.

FINMA's post-quantum guidance for Swiss banks, section by section: survey of 60 institutions, five recommendations, a PQC roadmap by mid-2027.