Should you build or buy Encryption & Key Management?
Encryption and key management software generates, rotates, stores and controls access to cryptographic keys that protect data at rest and in transit, often backed by hardware security modules for regulated custody requirements. Organizations use it to meet compliance mandates like FIPS 140-3 and to centralize keys scattered across cloud and on-prem systems.
Copy reviewed 2026-10-04 · Research revision 2026-09-25
Sources: hashicorp.com; hashicorp.com; adfinis.com; docs.gitlab.com; aws.amazon.com
Use your cloud provider's KMS as the baseline for cloud-native keys, buy an HSM-backed enterprise platform where validated hardware custody or multi-cloud governance is mandated, and self-host Vault or OpenBao only when portable secrets automation across your own estate justifies running the service.
Build it, buy it, or bridge?
When building makes sense
Self-hosted Vault and OpenBao run key lifecycle and application encryption in regulated production. NORD/LB centralized key management on HashiCorp Vault, and its IT security specialist says manual key rotation went from three or four full days a month to under five minutes. BBVA runs a three-node on-premises Vault cluster for its infrastructure and Vault Enterprise for critical banking applications. Wavelo moved its secrets platform to OpenBao, cut licensing costs by 60% and halved maintenance overhead, and GitLab's Secrets Manager is built on OpenBao. AI coding assistants make the operational tooling around a Vault cluster faster to build than before. What these deployments don't replace is validated hardware custody. None of these teams built its own cryptographic module, and teams that need FIPS-validated hardware or KMIP interoperability still buy that piece.
When buying makes sense
Use your cloud provider's KMS as the default for cloud-native keys, and buy an HSM-backed platform only where validated hardware custody or multi-cloud governance is an actual requirement. AWS KMS runs $1 per key per month plus $0.03 per 10,000 requests and uses FIPS 140-3 Level 3 validated hardware underneath, which covers most cloud-native use cases without a separate purchase. Enterprise platforms like Entrust KeyControl, Fortanix and Thales CipherTrust don't publish a per-key rate; expect a quote. They make sense once you have real multi-cloud governance requirements or a regulator asking for validated hardware custody evidence a software-only deployment can't provide. Buy when custody validation is mandatory; use the cloud default otherwise.
The desk read
Build-versus-buy analysis for Encryption & Key Management is being written. In the meantime, the framework that drives every B4 call is on the B4 Index page.
Frequently asked
What is encryption and key management software?
It is the control point for every other security tool. NORD/LB's move to centralize key rotation on HashiCorp Vault cut the work from three to four full days a month to under five minutes, which shows how much of the cost in this category is operational, not licensing.
Is self-hosting HashiCorp Vault viable for a bank or enterprise?
Yes. BBVA runs a three-node on-premises Vault cluster plus Vault Enterprise for critical applications, Wavelo moved its secrets platform to OpenBao and cut licensing costs by 60%, and NORD/LB cut manual key rotation from three or four days a month to under five minutes after centralizing on Vault.
When do you need a dedicated HSM-backed key management platform?
When FIPS 140-3 Level 3 hardware custody or multi-cloud governance is a contractual or regulatory requirement. Cloud provider KMS already covers cloud-native use cases at roughly $1 per key per month without a separate platform purchase.
What are the main encryption and key management vendors?
Representative vendors include Entrust KeyControl, Fortanix. B4 Pro includes the category score and the full vendor list.