What Keytos does

Keytos is a Boston-based private cybersecurity company founded in 2021 that delivers a cloud-native passwordless authentication and PKI platform purpose-built for Microsoft Azure environments. Its integrated product suite spans EZCA (cloud certificate authority with HSM-backed root CAs, ACME/SCEP support, CRL/OCSP validation), EZRADIUS (RADIUS-as-a-Service with EAP-TLS for Wi-Fi and wired network authentication), EZCMS (self-service FIDO2 and smart card enrollment), EZSSH (certificate-based SSH access tied to Entra ID identity), and EZMonitor (certificate transparency and SSL lifecycle monitoring), supplemented by open-source tools (CloudWatcher for Azure RBAC monitoring, CodeSigning GitHub Action).

The platform is hosted on Azure with 20+ deployment regions and integrates natively with Entra ID, Intune, and Microsoft 365; it also supports Azure Government and GCC High for regulated workloads and is FIPS 140-2 validated. Keytos holds ISO 27001 and SOC 2 Type 2 certifications and is a member of the Microsoft Intelligent Security Association (MISA). It monetizes through subscription licensing, usage-based pricing (especially for Cloud RADIUS and PKI operations, including a pay-per-active-user model for education), and professional services. Distribution combines direct enterprise field sales with Carahsoft (government aggregator), LiquidPC, a global MSP partner network, and self-serve marketplace listings on Microsoft Marketplace, Microsoft Security Store, and Jamf Marketplace.

Target customers are segmented by vertical: Government (primary, including U.S. federal/state/local agencies seeking FedRAMP/CMMC-aligned passwordless and PKI), Financial Institutions (PCI DSS v4 certificate transparency), Healthcare (HIPAA-compliant medical device and patient data security), IoT/Smart Devices (large-scale certificate provisioning), Education (campus Wi-Fi), and Critical Infrastructure. The company is led by co-founder and CEO Igal Flegmann and operates with a 1–10 person team.

Name

Keytos

Legal name

Keytos LLC

Website

https://keytos.io

Company type

Private

Founded year

2021

Operating status

Operating

Headcount range

1–10 employees

Short description

Keytos is a Boston-based cybersecurity company providing cloud-native passwordless authentication and PKI solutions built on Microsoft Azure, serving government, financial, healthcare, IoT, education, and critical infrastructure customers through direct sales, Carahsoft, MSP partners, and Microsoft/Jamf marketplaces.

Ownership category

akta.pro rank

Product category

Identity & Access Management (Cloud PKI and Passwordless Authentication)

NAICS

Computer Systems Design and Related Services (5415), Computer Systems Design and Related Services (54151), Security Systems Services (except Locksmiths) (561621)

SIC

Services-Computer Integrated Systems Design (7373), Services-Computer Programming, Data Processing, Etc. (7370), Services-Computer Programming Services (7371)

akta.pro primary industry

Device Identity & Certificate-Based Authentication (PKI) (BPAMAEAL)

akta.pro secondary industries

Key Management, Encryption & Secrets Management (KMS/HSM/Vault) (HDABAHAG), Machine & Workload Identity (PKI, Certificates, Service Accounts) (HDADAAAH), Identity, Access & Key Management (IAM/KMS) as Cloud Core Services (HDABAAAH)

Keywords

• Cloud PKI services
• Passwordless authentication
• Cloud RADIUS authentication
• Certificate lifecycle management
• Zero trust identity

Headquarters

HQ city

Boston

HQ country

United States

HQ region

North America

Offices1 record

Markets served

GTM type

B2B

Offering type

Software

Cost components

Technology or R&D, Personnel, Infrastructure, Marketing or Sales, Operations

Revenue model

1. SaaS/Subscription Licensing: Cloud-native PKI and passwordless authentication tools sold as subscription services. Pricing is based on usage metrics and user counts. The platform is deployed on Azure and delivered as managed services.
2. Usage-based Pricing: Cloud RADIUS and PKI services charge based on authentication volume and cryptographic operations. Education segment specifically mentioned using usage-based pricing for campus Wi-Fi.
3. Professional Services: Implementation, onboarding, and integration services for enterprise customers deploying passwordless solutions.

Pricing tiers

Go-to-market motion3 records

Distribution channels6 records

Marketing channels7 records

Core offering

Keytos provides a cloud-native PKI and passwordless authentication suite built on Microsoft Azure, comprising EZCA (Cloud PKI), EZRADIUS (Cloud RADIUS), EZCMS (FIDO2/smart card onboarding), EZSSH (zero-trust SSH), and EZMonitor (SSL/certificate transparency). The platform issues and manages X.509 certificates with HSM-backed root CAs, automates certificate lifecycle operations, and integrates with Microsoft Entra ID, Intune, and Azure Government/GCC High for passwordless, certificate-based authentication across cloud, on-premises, hybrid, and IoT environments.

Product overview

Keytos Security offers an integrated suite of passwordless identity and PKI solutions built for cloud and hybrid environments. The product portfolio centers on five core SaaS offerings: EZCA (cloud-native PKI for certificate automation), EZRADIUS (cloud RADIUS for network authentication), EZCMS (smart card/FIDO2 onboarding and management), EZSSH (zero-trust SSH with certificate-based authentication), and EZMonitor (SSL monitoring and certificate transparency). These products are designed to work together as an integrated ecosystem—EZCA provides the underlying certificate infrastructure that powers certificate-based authentication across EZCMS, EZRADIUS, and EZSSH, while EZMonitor ensures certificate visibility and compliance. The suite is built on Azure and deeply integrates with Microsoft Entra ID, Intune, and Azure services. Keytos also maintains open source tools including CloudWatcher (Azure RBAC monitoring) and CodeSigning (GitHub Actions integration). The company targets enterprises across government, financial, healthcare, and IoT sectors seeking to eliminate password-based vulnerabilities through phishing-resistant authentication.

Differentiator

Problem solved

Functional benefit

Brands

• EZSSH: Zero Trust SSH authentication solution for Entra ID customers enabling passwordless SSH access with short-term certificates.
• EZCA
• EZMonitor
• EZRADIUS
• EZCMS
• EZSmartCard

Products and services

• EZCA (Cloud PKI) Cloud-native Public Key Infrastructure (PKI) solution for Azure that automates X.509 certificate issuance, renewal, and management, with HSM-backed root CAs, CRL/OCSP validation, and ACME/SCEP protocol support. Used by enterprises and government agencies to centralize certificate lifecycle management and enable certificate-based authentication.
• EZRADIUS (Cloud RADIUS) Cloud-based RADIUS-as-a-Service for network authentication that integrates with Microsoft Entra ID and Intune, supporting EAP-TLS and WPA Enterprise for secure Wi-Fi and wired network access. Targeted at enterprises, education campuses, and government networks needing certificate-based Wi-Fi authentication.
• EZCMS (Passwordless Onboarding) Smart card and FIDO2 key management system that enables self-service passwordless enrollment of YubiKeys and smart cards, with one-click self-service enrollment to reduce IT help desk tickets. Used by enterprises to roll out phishing-resistant authentication at scale.
• EZSSH (Zero Trust SSH) Agentless passwordless SSH authentication solution that uses Microsoft Entra ID identity to issue short-lived SSH certificates, eliminating static SSH key management and enabling just-in-time access to Linux endpoints and servers. Used by engineering and infrastructure teams for zero-trust SSH.
• EZMonitor (SSL Monitoring) Certificate transparency monitoring and SSL certificate management service that detects fraudulent certificates, prevents outages from expired certificates, and helps meet PCI DSS v4 requirements. Used by financial institutions, enterprises, and security teams for certificate visibility.
• CloudWatcher Open-source tool for monitoring Azure role-based access control (RBAC) permissions to ensure only managed service identities have appropriate access to resources, with alerts for unauthorized access changes. Used by cloud and security teams to audit Azure access posture.
• CodeSigning Open-source GitHub Action for automated cryptographic code signing of software artifacts in CI/CD pipelines. Used by engineering teams to sign build outputs.
• JIT GitHub Access Just-in-time access solution for GitHub that issues temporary SSH certificates for secure repository access without permanent credentials. Used by engineering organizations adopting zero-trust principles for source code access.

Quantifiable outcome

• Reduce IT costs by up to $330 per user annually by eliminating password reset tickets and help desk overhead
• +6 more outcomes

Named customers3 records

Segments6 records

Ideal customer profiles3 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Integration9 records

Feature6 records

Partnerships

Six partnerships are on record, tiered core and minor.

• Carahsoft Technology Corp.coreChannel Partner/ Reseller/ Distributor · 8 June 2026Carahsoft serves as Keytos's Master Government Aggregator to make passwordless identity and PKI solutions available to U.S. government agencies. Solutions include cloud-native PKI, smart card onboarding, network authentication, and certificate management tools designed to help agencies meet Federal cybersecurity requirements including FedRAMP, CMMC, and Executive Order 14028. Partnership expands Keytos's distribution reach across Federal, State, and Local Government while strengthening Carahsoft's cybersecurity solutions portfolio.
• MicrosoftcoreTechnology or IntegrationKeytos is a Microsoft Partner and member of the Microsoft Intelligent Security Association (MISA). Products integrate seamlessly with Microsoft Entra ID, Intune, and Azure services. Solutions available in Microsoft Marketplace and Microsoft Security Store.
• YubicocoreTechnology or IntegrationKeytos participates in the Yubico Network and is recognized as Yubico's onboarding partner for YubiKey deployment. The partnership enables best-in-class hardware authentication support, extending existing secure identities across the Keytos toolset.
• LiquidPCminorChannel Partner/ Reseller/ DistributorLiquidPC helps connect customers with secure, modern endpoint and infrastructure strategies supporting operational outcomes. Partnership helps organizations pair secure device experiences with strong identity controls and certificate-backed access.
• JamfminorChannel Partner/ Reseller/ DistributorEZCA Cloud PKI and EZRADIUS Cloud RADIUS are available in the Jamf Marketplace, providing organizations with seamless access to advanced security solutions that integrate directly with Jamf for Apple device management.
• MSP Partner NetworkcoreChannel Partner/ Reseller/ DistributorGlobal network of managed service providers that help customers deploy, integrate, and manage Keytos technologies. MSPs provide local expertise and support for passwordless identity and PKI initiatives around the world.

Scale indicators10 records

Recent moves6 records

Expansion highlights6 records

Direct peers

• DigiCert: DigiCert is one of the largest commercial Certificate Authorities and PKI platform providers, offering certificate lifecycle management, TLS/SSL, and private PKI. It is the most direct competitor to Keytos's EZCA cloud PKI, especially for enterprise and IoT certificate use cases.
• Keyfactor: Keyfactor provides enterprise PKI-as-a-service and certificate lifecycle management (EJBCA, SignServer). It competes head-to-head with Keytos's EZCA in machine identity, IoT, and enterprise certificate automation.
• Sectigo: Sectigo is a major commercial CA offering SSL, private PKI, and IoT/device identity solutions. Its cloud-native certificate management product directly overlaps with Keytos's EZCA in enterprise and IoT segments.
• Entrust: Entrust provides PKI, TLS/SSL certificates, and identity solutions including smart card and credential management. Its PKI and credentialing offerings overlap with Keytos's EZCA and EZCMS passwordless onboarding.
• Portnox: Portnox offers cloud-native network access control (NAC) and cloud RADIUS services for enterprise Wi-Fi and wired authentication. It competes directly with Keytos's EZRADIUS Cloud RADIUS for Microsoft-centric environments.
• HID Global (ActivID / IdenTrust): HID Global provides identity and PKI solutions including smart cards, credential management, and authentication. Its PKI and credential lifecycle products overlap with Keytos's EZCA and EZCMS passwordless onboarding for government and enterprise.
• SecureW2: SecureW2 provides cloud-based PKI and RADIUS solutions with native integration to Microsoft Entra ID for certificate-based Wi-Fi authentication. It is a near-direct competitor to Keytos's EZRADIUS and EZCA in education and enterprise segments.

Broad incumbents

• Okta: Okta is a leading identity and access management platform offering SSO, MFA, and passwordless authentication. It competes broadly with Keytos's passwordless authentication stack, though it does not specialize in PKI/certificate issuance like EZCA.
• Cloudflare: Cloudflare operates a global network and security platform offering Zero Trust Network Access (Cloudflare Access) and Tunnel services. Its Zero Trust edge competes with Keytos's EZSSH for agentless, identity-based access control.

Emerging players

• JumpCloud: JumpCloud offers a cloud directory platform with SSO, MFA, and passwordless features targeted at SMB and mid-market. It overlaps with Keytos's passwordless and certificate-based authentication offerings for organizations without on-prem AD.

Market position

Strengths4 records

Weaknesses5 records

Competitive moat4 records

Key risks5 records

Key highlights7 records

Customer concentration

• Xx.com/keytos_security
• GitHubgithub.com/markeytos
• YouTubeyoutube.com/channel/UCS8cOE0k_qORCEeBGZ9WYtQ
• LinkedInLinkedIn.com/company/keytossecurity

Compliance6 records

Revenue estimate

Valuation estimate

Number of profiles

Profiles1 record

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Keytos