Keytos makes passwordless authentication practical for organisations that run on Microsoft Entra ID, Intune and Azure. Its hosted services replace on-premises certificate authorities, RADIUS servers and static SSH keys with cloud PKI and certificate-based access, across cloud, hybrid, on-premises and IoT environments.
The customer gets the security of certificates without running the infrastructure behind them, which matters most for IT teams that have moved identity to the cloud but still depend on servers they would rather retire.
At A Glance
| Vendor | Keytos |
|---|---|
| Category | Cloud PKI, certificate-based and passwordless authentication |
| Identities covered | Workforce users, managed and personal devices, IoT devices, SSH hosts, TLS certificates |
| Deployment | SaaS in more than 20 commercial and government regions, deployed from the Azure Marketplace |
| Certifications | SOC 2 Type II, ISO 27001, FIPS-validated infrastructure |
| Headquarters | Boston, United States |
| Market classification | Identity Verification |
What Keytos Does
Keytos sets out to make passwordless security easy by keeping it invisible to users, using cryptographic tools rather than passwords. Running PKI and RADIUS in-house means servers to host, patch and keep highly available; Keytos runs them as services instead, with nothing for the customer to host or patch.
Everything revolves around certificates. A certificate issued to a laptop, phone or sensor can prove its identity to Wi-Fi, VPN or an IoT hub; a short-lived certificate can stand in for an SSH key; and a smart card or passkey can replace a password at sign-in.
Products
Keytos Shield
Keytos Shield bundles cloud PKI, network authentication and passwordless onboarding for teams that want one subscription rather than separate tools. The PKI issues certificates through SCEP, ACME and smart card onboarding, and managed RADIUS with RadSec is included. Keytos Connect is a BYOD app for getting personal devices onto Wi-Fi. Shield is available to Azure GCC High customers and tenants.
EZCA
EZCA is a cloud certificate authority built on Azure and backed by HSMs. It runs public and private CAs, root and subordinate, and issues through Intune SCEP, ACME and EST, at the scale Azure IoT Hub and IoT Central fleets need. Basic CAs use FIPS 140-3 Level 2 HSMs, Premium CAs Level 3, or customers can bring their own HSM. Organisations moving off Active Directory Certificate Services can keep their on-premises root and issue from the cloud.
EZRADIUS
EZRADIUS is cloud RADIUS for network access, built for Entra ID and Intune. On every connection attempt it enforces Entra ID group membership and Intune device compliance, so only the right users on healthy devices get onto the network. It supports EAP-TLS, PEAP-MSCHAPv2 and EAP-TTLS, and accepts certificates from EZCA, AD CS, Microsoft Cloud PKI or another PKI.
EZSSH
EZSSH removes SSH key management. Engineers sign in with their Entra ID identity and receive a certificate scoped to that user, endpoint and connection, which expires on its own, so there are no keys to rotate or revoke. Each access policy gets its own HSM-backed CA, and the approach works on any SSH-enabled host in the cloud or on premises.
EZCMS
EZCMS guides employees onto phishing-resistant MFA. It enrols YubiKeys for FIDO2 passkeys and Entra ID certificate-based authentication, and confirms who the employee is during enrolment with face recognition and government ID scanning.
EZMONITOR
EZMONITOR watches SSL certificates on the internet and inside the network. Public certificates are tracked through Certificate Transparency logs, and it raises an alert when a certificate appears from an unexpected CA.
How It Works
All Keytos services are hosted, with a choice of more than 20 commercial and government regions. Customers deploy from the Microsoft or Azure Marketplace and are billed through their Azure subscription.
| Certificate authority | EZCA CAs run in Keytos-hosted Azure infrastructure with keys in HSMs, optionally chained to an existing on-premises root |
|---|---|
| Network access | Access points and switches send RADIUS requests to EZRADIUS, which queries Entra ID and Intune before answering |
| SSH access | Administrators register a tenant and create an access policy; engineers request access through the EZSSH CLI and sign in with their corporate identity, and hosts trust the policy CA through a downloadable script |
| Monitoring | Public certificate monitoring needs nothing deployed, while internal certificates are found with the Enterprise network scan |
Identities And Systems Covered
| Workforce users | Entra ID users signing in with certificates, FIDO2 passkeys and smart cards |
|---|---|
| Devices | Intune-managed and personal devices joining Wi-Fi and network resources |
| IoT devices | Certificates for Azure IoT Hub and Azure IoT Central fleets |
| SSH hosts | Any SSH-enabled server, cloud or on premises |
| Certificates | Public and private TLS certificates |
Integrations
| Area | Integrations |
|---|---|
| Device management | Jamf Pro |
| Existing PKI | AD CS, Microsoft Cloud PKI, third-party PKI |
| Network equipment | Cisco Meraki, Fortinet, Ubiquiti UniFi, Ruckus, TP-Link Omada |
| Security keys | Yubico YubiKey |
Company Background
| Founders | Marcos Flegmann and Igal Flegmann |
|---|---|
| Headquarters | Boston, Massachusetts, United States |
| Ownership | 100% employee-owned, with no outside investors |
| Scale | More than 1,200 reported customer organisations, with EZRADIUS handling over 45 million RADIUS authentications a month |
Note: This overview is compiled from Keytos’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.