Comparison
QNSI vs Azure Key Vault
An honest, code-grounded side-by-side. The critical fact to start with: Azure Key Vault's own data-plane key-types page (learn.microsoft.com, last updated 2026-04-09) lists EC, RSA, and AES only - no PQC algorithms. Microsoft's SymCrypt library has ML-KEM and ML-DSA, but that's the library + Windows OS, NOT Azure Key Vault. Microsoft has a real PQC roadmap (2029 default-on, 2033 full transition); for buyers under CNSA 2.0 or APAC FSI procurement timelines that don't align with 2029, QNSI is the in-market alternative today.
Azure Key Vault is a mature, FIPS-validated, well-integrated KMS for Microsoft-shop customers. For an organisation whose stack is Azure + AD + M365 + Windows Server, Key Vault is the path of least resistance - and Microsoft's 2029 default-on roadmap is real. The honest question is whether your regulator's PQC timeline aligns with Microsoft's. If you need PQC operating live today across multi-cloud, sovereign, or APAC-regulated workloads, QNSI is the in-market alternative.
Side by side
Eleven categories that matter to a Microsoft-shop buyer evaluating PQC
| Category | QNSI | Azure Key Vault |
|---|---|---|
| PQC algorithms in the KMS data plane | 87 algorithms across 13 PQC families (24 KEMs + 63 signatures) in the active KMS data plane today. Tenants on Maximum and Government policy tiers operate ML-KEM-1024, ML-DSA-87, and SLH-DSA for production wrap/unwrap and sign/verify. Independently reproducible from github.com/heossihq/qnsi-public. | Zero NIST-finalized PQC algorithms in the Azure Key Vault data plane as of April 2026. The official 'Key types, algorithms, and operations' page (ms.date 2026-04-09) lists only EC (P-256, P-256K, P-384, P-521), RSA (2K/3K/4K with OAEP/PSS/PKCS1.5), and AES (KW/GCM/CBC). No ML-KEM, ML-DSA, FN-DSA, SLH-DSA, Falcon, or any PQC family. Source: learn.microsoft.com/azure/key-vault/keys/about-keys-details. |
| SymCrypt PQC vs Key Vault PQC | The QNSI KMS service uses liboqs (native C) + noble (pure JS) directly. PQC primitives are operated by the service that issues the keys - no separate library-OS-KMS distinction the buyer has to reason about. | Microsoft's SymCrypt library shipped ML-KEM + ML-DSA in the Nov 2025 Windows update, GA in Windows 11 / Windows Server 2025 via CNG APIs. That is library + OS, NOT Azure Key Vault. Microsoft's own Aug 2025 security blog does not list Azure Key Vault among PQC-GA surfaces. Sources: microsoft.com/security/blog/2025/08/20. |
| Microsoft's published PQC roadmap | QNSI ships PQC by default on every tier today. The 'when do we get PQC' question has the answer 'now' for new customers. | Microsoft has publicly committed to 2029 as the 'early adoption / quantum-safe capabilities default-on' target and 2033 as the 'full transition completion' target (the older U.S. NSM-10 target was 2035; U.S. Executive Order 14412 (2026) has since accelerated federal High-Value Assets to 2030/2031). Honest framing: this is a real roadmap from a serious vendor; the timeline gap between Microsoft's roadmap and a regulator-driven CNSA 2.0 procurement requirement is the procurement question. |
| HSM model + FIPS validation | Native software crypto by default, plus six capability-gated PKCS#11 connectors and two REST custody backends. Hardware custody and vendor-certificate scope require live qualification of the selected deployment. The current escrow route is not threshold recovery and is not presented as available. The QNSI service plane is not CMVP-validated. | Managed HSM + Key Vault Premium use Marvell LiquidSecurity adapters and are FIPS 140-3 Level 3 validated. Standard tier = FIPS 140-2 Level 1 (software). hsmPlatform attribute: 2 = FIPS 140-3 L3, 1 = FIPS 140-2 L2, 0 = software. Sources: learn.microsoft.com/azure/key-vault/managed-hsm/overview + about-keys-details. |
| Multi-cloud / portability | QNSI source includes 11 cloud-vendor discovery connectors and shared client contracts. Customer-VPC, on-premises, air-gapped, and sovereign topologies are engagement-specific and require deployment qualification. | Azure-only. No discovery of non-Azure keys, no cross-cloud key inventory. Migrating keys to AWS KMS / GCP KMS requires BYOK export/import per-key. Source: learn.microsoft.com/azure/key-vault/managed-hsm/overview. |
| Crypto-policy tier enforcement | Four hard-enforced tiers (default / strict / maximum / government) with per-tier algorithm allow-lists enforced at the edge gateway, KMS, and vault. A tenant cannot accidentally downgrade. | Per-tenant crypto-policy tier abstraction is not a built-in Key Vault capability. Customers compose policy via Azure Policy + per-key key_ops flags + per-vault RBAC. No equivalent default/strict/maximum/government enforcement model in the product. Source: learn.microsoft.com/azure/key-vault/keys/about-keys-details. |
| Audit trail | 59 crypto-critical event types across 12 source services flow into a hash-chained Merkle ledger. ML-DSA-65-signed events, SHA3-256/512 checkpoints, receipt-replay verification, real-time WebSocket streaming for SIEM. | Audit via Azure Monitor / Log Analytics. Tamper-evidence depends on log file integrity validation customers configure separately. PQC-signed audit events not advertised on the Managed HSM overview. Source: learn.microsoft.com/azure/key-vault/managed-hsm/overview. |
| Free tier + transparent pricing | Free forever: 20 KMS keys + 20,000 KMS ops/month + 25 vault secrets + 10 GB encrypted storage + 50,000 API calls/month, no credit card. Published ladder up to $5,999 business-elite plus enterprise. | No published Key Vault free tier; pay-as-you-go from first call. Standard/Premium operations: $0.03 per 10,000 transactions; cert renewals: $3/renewal; HSM-protected keys: $5/key/month for first 250. Managed HSM hourly per cluster (~$4.80/hr Standard B1 per third-party blogs - verify against azure.microsoft.com/pricing/details/key-vault). The HSM-key-month + ops-per-call structure can be hard to forecast at scale. |
| Compliance frameworks (product-specific) | Seven frameworks mapped at the control level: SOC 2, ISO 27001, HIPAA, PCI DSS v4.0.1, GDPR, PDPA (Singapore), MAS TRM. Real-time evaluation from live service-health probes. | Azure Key Vault is in scope under Microsoft Trust Center for HIPAA, PCI DSS, SOC 1/2/3, ISO 27001, FedRAMP. PDPA (Singapore) and MAS TRM are not explicitly enumerated on the Key Vault product pages - Azure as a platform claims regional coverage via Trust Center, but Key Vault's product-page enumeration omits these APAC frameworks. |
| Microsoft ecosystem integration (genuine Azure strength) | Direct REST / SDK / CLI integration. Microsoft customers can run QNSI against Azure Key Vault BYOK + Azure Dedicated HSM as backing custody. | For a Microsoft-shop customer, Key Vault is the path of least resistance for AD-CS PQC (when it ships), M365 integration, Windows Server 2025 CNG, and Azure-native services that expect Azure-native KMS. This is a real and significant Microsoft strength worth acknowledging. |
| Multi-cloud crypto-posture | Crypto-inventory contracts span 11 cloud-vendor connector families and 36 normalized source types, with CycloneDX CBOM export. Complete connector execution and estate coverage remain deployment-specific. | Azure Key Vault does not discover or inventory non-Azure cryptographic assets. Source: learn.microsoft.com/azure/key-vault/managed-hsm/overview. |
When to pick which
Honest decision guide
Stay on Azure Key Vault if…
- You are 100% Microsoft / Azure and your regulator's PQC timeline aligns with Microsoft's 2029 default-on / 2033 transition roadmap.
- Your data lifecycle is under 7 years and your threat model excludes HNDL (harvest-now-decrypt-later) attacks on long-lived ciphertext.
- Classical RSA / ECC keys are sufficient for your compliance regime through the end of this decade.
Add QNSI on top if…
- You have data with retention beyond 7 years that an adversary could harvest today and decrypt later.
- You're under regulator pressure (MAS TRM, NSA CNSA 2.0 January 2027 deadline, PDPA-binding workloads) to show a PQC migration plan now.
- You need multi-cloud or hybrid-cloud crypto posture beyond Azure-only, or you operate in sovereign / air-gapped environments.
Replace Key Vault with QNSI if…
- You're starting greenfield - no migration cost, get PQC by default on day one.
- You operate in regulated sectors (financial services, government, defence, healthcare) where the auditor is asking about NIST CNSA 2.0 January 2027 today.
- Your application stack uses Python / Go / Rust as much as C# / TypeScript and you want one consistent SDK across languages and clouds.
Verify the QNSI claims
Review the source and evidence boundary behind each comparison
QNSI's algorithm registry, policy tiers, audit-event types, and tier limits are all published at github.com/heossihq/qnsi-public. The Azure Key Vault claims link to learn.microsoft.com primary documentation and Microsoft Security Blog posts dated April-November 2025 and April 2026. If anything is wrong or outdated, email qnsi-legal@heossi.com - we'll re-verify and correct.