All analysis was generated autonomously, without human review. Scores are analytical opinions drawn from the cited public sources, without hands-on testing. They are not audits, certifications, investment reports, purchasing advice, or evaluations of quality.
Entrust sells security hardware and software to governments, banks and enterprises. Its products run from nShield hardware security modules, tamper-resistant devices protecting encryption keys, to identity verification and passport issuance. Founded in 1969, it is owned by a German family and profitable, with about 10,000 customers and just under $1 billion in yearly revenue, its then-CEO told TechCrunch in 2024. Its named customers include Visa, Mastercard and the UK Home Office. Entrust no longer issues website certificates browsers trust. It sold that business to Sectigo after Google Chrome distrusted its new ones over reported compliance failures. Square made nShield a required part of its payment architecture, so a rival hardware maker would be replacing built-in equipment there.
| Description | Entrust sells digital security hardware and software, spanning identity verification and authentication, card and ID issuance, certificate and key lifecycle management, hardware security modules, and post-quantum cryptography. The company is privately held. | [f1] |
|---|---|---|
| Founded | 1969 | [f2] |
| HQ | Shakopee, Minnesota, United States | [f1] |
| Latest funding | Privately owned by a German family, with no shareholders as such (2024) | [f3] |
| Product | What it does |
|---|---|
| nShield HSMs | Hardware security modules that provide a FIPS-certified, tamper-resistant root of trust for generating, protecting, and managing cryptographic keys. |
| PKI and Certificate Lifecycle Management | Software for running private and managed certificate authorities and for discovering, managing, and automating keys, certificates, and secrets across an enterprise. |
| Identity Verification | AI-powered document, biometric, and data checks (built on the acquired Onfido technology) that confirm customer, citizen, and employee identities at onboarding. |
| Card and Credential Issuance | High-volume hardware, software, services, and supplies (the Datacard product line) for issuing physical and digital payment cards, national IDs, and other secure credentials. |
| Cryptographic Security Platform | A single platform for PKI, nShield HSMs, and the lifecycle management of keys, certificates, and secrets, offered as a service or on premises. |
| Identity and Access Management (IDaaS) | An identity-as-a-service platform that provides user authentication, authorization, and access control. |
Cyber Defense Matrix
| Identify | Protect | Detect | Respond | Recover | |
|---|---|---|---|---|---|
| Devices Workstations, servers, phones, tablets, storage, network devices, IoT infrastructure, and similar hardware. | |||||
| Applications Software, interactions, and application flows on the devices. | |||||
| Networks Connections and traffic flowing among devices and apps, plus communication paths. | |||||
| Data Content at rest, in transit, or in use across devices, apps, and networks. | |||||
| Users The people using the devices, apps, networks, and data. |
Entrust nShield HSMs protect cryptographic keys, PKI and the Cryptographic Security Platform manage certificates and keys, Identity Verification and IDaaS confirm and authenticate people, and Card and Credential Issuance produces cards and IDs. These lines are mapped to the Cyber Defense Matrix. [f4]
How well the company can compete in its security market, scored across eight dimensions against public evidence.
| Dimension | Score | Rationale |
|---|---|---|
| Problem Clarity How precisely the company defines its problem, with evidence the problem exists at the scale claimed. | 3/5 | Entrust names clear buyers and problems across identity verification, authentication and cryptographic operations, such as helping financial institutions verify customers at account opening for KYC and AML compliance. It quantifies the pain mostly in its own voice, through a ZF case study on tracking expiring certificates and an Onfido deepfake figure in its newsroom. The CA/Browser Forum ballot cutting validity toward 47 days and NIST's post-quantum urgency set requirements without measuring buyer losses, so the independent quantification the next rung requires is missing. [s5, s15, s11, s29, s28] |
| Capability Depth How specific the technical capabilities are, with evidence beyond marketing claims such as docs and third-party validation. | 4/5 | Entrust documents its HSM, PKI and verification products in technical detail, and NIST’s CMVP list carries an active validation certificate for the nShield 5s module dated June 2026. Entrust reports that NIST’s algorithm program validated nShield’s post-quantum algorithms in 2025, and Square describes picking nShield after testing multiple vendors. No independent benchmark in the cited record compares nShield with rival modules, so the depth is corroborated rather than shown beyond peers. [s2, s3, s5, s12, s14, s26] |
| Market Timing Whether the market is ready for this product, with evidence that buyers are actively seeking solutions. | 4/5 | Two buyer-side signal kinds fall within the last twelve months. A regulatory driver: the CA/Browser Forum’s schedule began cutting public TLS certificate lifetimes in March 2026 on the way to 47 days (s29). An analyst category note: KuppingerCole’s March 2026 enterprise passwordless report says organizations accelerated efforts to remove passwords through 2025 and into 2026, a market Entrust’s authentication products serve (s25). NIST’s 2024 post-quantum standards are an older enabler outside the window. [s29, s25, s3, s6, s28] |
| Team Credibility Demonstrated domain expertise with public signals such as prior exits, publications, and industry recognition. | 3/5 | Tony Ball became chief executive in March 2026 after senior roles at HID Global and Gemalto, and BankInfoSecurity reports he ran Entrust’s payment and identity business from October 2023. The cited record describes in-domain leadership, with no named product build, exit or publication credited to the team. Google questioned Entrust’s competence as a public certificate authority in 2024, and Entrust has since sold that business. [s8, s23, s19, s18] |
| GTM Proof Evidence of actual traction (customers, revenue signals, partnerships) beyond stated intentions. | 4/5 | Entrust names many reference customers, listing Visa, the UK Home Office, Navy Federal Credit Union, Revolut, Regions Bank and Mastercard on its homepage and describing deployments at Square, ZF Friedrichshafen and BancoEstado in case studies. Its scale figures are the company’s own: then-CEO Todd Wilkinson told TechCrunch in 2024 that Entrust had about 10,000 customers and just under $1 billion in annual revenue. With the scale self-reported and its analyst placements shown on its own pages, the traction is multiply evidenced but not independently corroborated. [s1, s9, s14, s15, s22, s16] |
| Funding Efficiency Whether funding matches go-to-market ambition, with signs of capital-efficient growth. | 4/5 | Then-CEO Todd Wilkinson told TechCrunch in 2024 that Entrust had been profitable for years, earned just under $1 billion a year and is privately owned by a German family with no shareholders as such. Over the same years Entrust acquired nCipher, HyTrust, WorldReach and Onfido while shipping several product lines. The profitability claim is the company’s own and the cited record carries no margin figure, which keeps the score below the independently confirmed level. [s22, s18] |
| Category Clarity Whether the company creates or fits a recognizable category that buyers can quickly place in their stack. | 4/5 | Hardware security modules, PKI, identity verification, access management and card issuance are established categories buyers place without coaching. KuppingerCole listed Entrust among the leaders in its 2024 enterprise passwordless report, and its March 2026 edition lists Entrust as a vendor to watch. Entrust’s Gartner placements, a Challenger in access management and a Visionary in identity verification, appear on its own pages, and no independent source in the cited record names it a category definer. [s24, s25, s16, s6] |
| Incumbent Defensibility How vulnerable the core value proposition is to absorption as a feature by a platform vendor. | 3/5 | The HSM line gives a platform vendor real friction to work through: customers keep keys in NIST-validated nShield hardware, Entrust lists integrations with more than 150 partner applications, and Square made HSMs a required element of its payment architecture. The cited record shows no data flywheel or replacement-blocking mandate behind that friction, and Entrust no longer runs a public certificate authority after selling that business to Sectigo in January 2025. [s2, s14, s26, s18] |
Entrust sells identity-centric security that protects people, devices and data to governments, financial institutions and enterprises. Its products cover the steps where an organization has to trust an identity: verifying a person, issuing a card or passport, authenticating access, and protecting the keys and certificates behind machine connections.
The CA/Browser Forum approved a schedule reducing maximum public TLS certificate validity from 398 days to 47 days, starting in March 2026, and Entrust markets its certificate lifecycle automation against that schedule. NIST finalized its first post-quantum encryption standards in 2024 and urged administrators to begin transitioning as soon as possible. Entrust markets nShield firmware carrying NIST’s post-quantum algorithms to buyers preparing for that move. [s1, s3, s12, s28, s29]
Entrust runs a broad trust stack for one vendor. nShield hardware security modules keep cryptographic keys in tamper-resistant hardware, while Entrust offers PKI as on-premises software or a managed service. Its Onfido-based identity verification checks documents and biometrics, and its IDaaS platform handles authentication and access control. The issuance line personalizes payment cards, IDs and passports.
The Cryptographic Security Platform now ties the key, certificate and secrets lines together. Entrust describes it as one platform for PKI, HSMs and key, certificate and secrets lifecycle management. In September 2026, Entrust added import and export of cryptographic inventories, called Cryptographic Bills of Materials. Buyers can deploy the platform on premises or use it as a service.
Independent validation backs the HSM line. NIST’s CMVP list shows an active validation certificate for the nShield 5s module dated June 2026, and Entrust reports that NIST’s algorithm program validated nShield’s implementations of three post-quantum algorithms in 2025. [s2, s3, s4, s5, s6, s7, s12, s13, s26]
Entrust competes line by line rather than as a single product. In enterprise passwordless authentication, KuppingerCole’s 2024 report listed Entrust among the leaders alongside Thales, CyberArk, Okta, Microsoft and others. The March 2026 edition lists Entrust as a vendor to watch, and its Overall Leaders list, which includes Thales, CyberArk and Okta, does not include Entrust.
Entrust shows Gartner placements on its own pages that rank it a Challenger in access management for a third consecutive year and a Visionary in identity verification. In PKI, Entrust shows an ABI Research report naming it a leader and top innovator among enterprise PKI vendors. [s24, s25, s16, s6]
Entrust sells to large regulated organizations at scale, by its own account. Then-CEO Todd Wilkinson told TechCrunch in 2024 that Entrust had about 10,000 customers, including governments, major banks and large enterprises, and just under $1 billion in annual revenue. Entrust says it has deployed more than 100,000 HSMs across government, financial and technology organizations.
Named customers appear on Entrust’s own pages. Its homepage lists Visa, the UK Home Office, Hitachi, Navy Federal Credit Union, Revolut, Walmart Chile, Regions Bank and Mastercard under a trusted-by heading, and its case studies describe Square using nShield modules as cryptographic anchors for its mobile payment card readers and ZF Friedrichshafen securing its enterprise PKI with nShield.
Entrust grew the identity verification line by acquiring Onfido, a deal it completed in April 2024 without disclosing terms. [s22, s2, s1, s9, s14, s15, s11]
Entrust’s current leadership came up inside the company. Tony Ball became chief executive on March 31, 2026, succeeding Todd Wilkinson, who had led Entrust since 2008. Ball joined in 2016, led the access control, authentication and Payments & Identity businesses, and earlier held senior roles at HID Global and Gemalto. Mike Baxter, who leads all Entrust product management and development teams, has been on the leadership team since 2010.
BankInfoSecurity reported that Ball plans to extend Entrust’s identity work from onboarding to the full identity life cycle.
Google’s 2024 distrust of Entrust’s public certificates counts against that record. Google said a pattern of incidents had eroded confidence in Entrust’s competence as a publicly trusted certificate authority, and Entrust sold the business to Sectigo in January 2025. [s8, s23, s18, s19]
Entrust’s HSM line holds independent product credentials. NIST’s CMVP list shows an active validation certificate for the nShield 5s module, Square’s case study says the FIPS-certified nShield can help streamline its audits, and Entrust sells a WebTrust-audited cloud PKI.
Google stopped trusting Entrust’s public TLS certificates in 2024 after what Infosecurity Magazine described as a series of reported compliance failures, with Chrome blocking certificates issued from November 2024. Google’s action covered new TLS server authentication certificates, a business Entrust sold to Sectigo in January 2025, and Sectigo said it migrated more than half a million certificates.
NVD lists CVE-2025-59702, published in December 2025, which lets a physically proximate attacker with elevated privileges falsify tamper events on several nShield models. Fixed firmware is listed, so firmware currency belongs in a buyer’s review. [s26, s14, s3, s19, s20, s21, s18, s27]
| Company | Relationship | Note | Compare |
|---|---|---|---|
| Keyfactor | competes with | ||
| Thales | competes with | N/AWe scored these companies at different scopes, so the totals measure different things. | |
| DigiCert | competes with | ||
| CyberArk | adjacent | N/AWe captured the evidence for these companies under different evidence-model versions (v1 vs v2), so the totals were scored under different conditions and are not directly comparable. | |
| Okta | adjacent |
Add analyzed competitors to compare them side by side with Entrust.
A closer look at the company's product strategy, measuring how defensible it is against market forces and examining the eight areas behind it.
press the advantage
Entrust holds its position through what regulated customers have built on its products. Square made nShield hardware a required part of its payment architecture, ZF stores its certificate authority keys in nShield, and governments use Entrust systems to issue national IDs and passports.
| Dimension | Score | Rationale |
|---|---|---|
| Value Delivery Does the product sell software as the product, or judgment, trust, or accountability with software as the delivery mechanism. | 1/3 | Entrust sells hardware and software that the customer’s team operates and whose outcomes it owns: nShield modules, on-premises PKI, identity verification and the IDaaS platform. Managed PKI, where Entrust’s experts run a customer’s PKI, is an optional service route beside that core. |
| Switching Cost How expensive leaving is for a customer: data portability, integrations, learned workflows, network effects, regulatory data residency. | 2/3 | Hardware key custody is documented: nShield modules keep keys in tamper-resistant hardware and safeguard the root and certificate authority keys of a customer’s PKI, as ZF describes for its enterprise PKI. The cited record documents that custody but does not describe or size what moving away from it involves, so the documented case is meaningful friction rather than a migration shown to be expensive. |
| Compliance Moat Whether certifications, liability acceptance, or audit trails block an easy replacement. | 2/3 | NIST’s CMVP lists an active validation certificate for the nShield 5s module, Square’s case study says the FIPS-certified nShield can help streamline its audits, and Entrust sells a WebTrust-audited cloud PKI. Buyers could replace these products with equivalently validated alternatives over time, and no cited source describes a requirement to use Entrust. |
| Problem Complexity Whether the product requires ML, optimization, real-time systems, or years of specialized expertise. | 3/3 | Entrust builds tamper-resistant cryptographic hardware that NIST validates, implements NIST’s post-quantum algorithms in nShield firmware, and runs AI-based document and biometric checks in identity verification. That combination of secure hardware engineering, cryptography and machine learning meets the specialized-expertise bar. |
| Buyer Profile Whether buyers are SMB operators, mid-market IT teams, or regulated enterprises and governments with procurement gates. | 3/3 | Entrust sells to regulated buyers. Then-CEO Todd Wilkinson told TechCrunch that its roughly 10,000 customers include governments and major banks, its issuance line produces national IDs and passports, and its own case studies describe work for the UK Home Office, Navy Federal Credit Union and BancoEstado. |
| Layer Whether the product is an end-user application, a platform with application features, or infrastructure other applications depend on. | 3/3 | nShield modules sit in the execution path of customer applications: Square made HSMs a required element of its payment architecture, sized them against its encryption and authentication-code calls, and relies on them to give every product a unique key. Entrust’s IDaaS platform also provides authentication, authorization and access control. Card issuance and identity verification are application-style lines, so the dependence claim covers the cryptographic and access operations routed through nShield and IDaaS. |
| Proprietary Data, Content, or IP Whether the product accumulates datasets, content licenses, or IP that a rival cannot recreate from scratch. | 1/3 | Entrust’s identity verification draws on intelligence from its Entrust Fraud Lab and a continuously updating fraud engine. The cited record does not describe the intelligence’s origins or its retention as a vendor dataset. No granted patent or content licence appears in the record either. |
Entrust sells to regulated organizations that have to establish trust in identities, both people and machines. Its pages name governments, financial institutions and enterprises as the buyers, and then-CEO Todd Wilkinson told TechCrunch in 2024 that Entrust’s roughly 10,000 customers include governments, major banks and large enterprises.
Each product line serves a different team inside those accounts. Issuance serves card issuers and the agencies that issue national IDs and passports, identity verification serves onboarding teams, and the HSM, PKI and Cryptographic Security Platform lines serve the teams that manage keys and certificates.
Two outside changes press on the key and certificate buyers. The CA/Browser Forum approved a schedule reducing public TLS certificate lifetimes from March 2026 toward 47 days, and NIST urged administrators to begin moving to its post-quantum standards as soon as possible.
Entrust spans a broad trust stack for one vendor. nShield hardware security modules keep keys in tamper-resistant hardware, while Entrust offers PKI as on-premises software or a managed service. The IDaaS platform handles authentication and access control, and the issuance line personalizes payment cards, IDs and passports.
AI shows up most directly in identity verification, built on the Onfido technology Entrust acquired. Entrust markets AI biometrics and document intelligence that it says catch deepfakes and injection attacks, backed by intelligence from its Entrust Fraud Lab, and it markets onboarding in seconds.
Entrust reports that NIST’s algorithm program validated nShield’s implementations of ML-DSA, ML-KEM and SLH-DSA in 2025, and that it submitted nShield 5 firmware with those algorithms for updated FIPS 140-3 validation. NIST’s CMVP list shows an active validation certificate for the nShield 5s dated June 2026.
Entrust names its customers on its own pages. The homepage lists Visa, the UK Home Office, Hitachi, Navy Federal Credit Union, Revolut, Walmart Chile, Regions Bank and Mastercard under a trusted-by heading. Case studies describe Square using nShield modules as cryptographic anchors for its mobile payment card readers, ZF Friedrichshafen securing its enterprise PKI with nShield, and BancoEstado delivering government benefits through instant issuance.
Scale figures come from the company. Todd Wilkinson told TechCrunch in 2024 that Entrust had about 10,000 customers and just under $1 billion in annual revenue, and Entrust says it has deployed more than 100,000 HSMs.
KuppingerCole’s own pages list Entrust among the leaders in its 2024 enterprise passwordless report and as a vendor to watch in the March 2026 edition. Entrust’s Gartner and ABI Research placements appear on Entrust’s own pages.
Entrust invites nShield buyers to contact its HSM experts. The nShield page ends with a form that sends a buyer to one of Entrust’s HSM experts, and a request for entrust.com/pricing returned a 404 page on 2026-10-16.
Delivery choices shape what a buyer pays for. PKI comes as on-premises software or as a managed service run by Entrust’s experts, and the Cryptographic Security Platform is available as a service or for on-premises deployment, so a buyer chooses between running the product and paying Entrust to run it.
Entrust delivers in several forms. nShield modules are tamper-resistant physical devices, PKI comes as on-premises software, a container-based virtual appliance or a managed service, and the Cryptographic Security Platform runs as a service or on premises.
Customers build these products into core processes. Square uses nShield hardware to give every Square product its own unique key, and ZF relies on nShield for its CA key storage.
Entrust’s HSM line carries independent product credentials. NIST’s CMVP list shows an active validation certificate for the nShield 5s module, Square’s case study says the FIPS-certified nShield can help streamline its audits, and Entrust sells a WebTrust-audited cloud PKI.
Google stopped trusting Entrust’s new public TLS certificates in 2024, saying a pattern of incidents had eroded confidence in Entrust as a publicly trusted certificate authority, and Chrome blocked certificates issued from November 2024. Entrust sold that public certificate business to Sectigo in January 2025.
NVD lists CVE-2025-59702, published in December 2025, which lets a physically proximate attacker with elevated privileges falsify tamper events on nShield Connect XC, 5c and HSMi firmware through 13.6.11 or 13.7. Fixed versions are listed, so firmware currency belongs in a buyer’s review.
Entrust connects its key and certificate lines into one platform. The Cryptographic Security Platform brings PKI, HSMs and key, certificate and secrets lifecycle management together, and in September 2026 Entrust added Cryptographic Bill of Materials import and export to it.
The HSM line reaches into other vendors’ products. Entrust lists integrations with more than 150 partner applications and platforms, and HSMs commonly protect keys for PKI, digital signing, database encryption, payment processing and privileged access management.
Much of the breadth came through acquisition. nCipher brought the nShield line in 2019, and Onfido brought identity verification in 2024, alongside HyTrust and WorldReach in 2021.
Entrust’s leadership came up inside the company. Tony Ball became chief executive on March 31, 2026, succeeding Todd Wilkinson, who had led Entrust since 2008, and BankInfoSecurity reported that Ball ran the payment and identity business from October 2023. Before Entrust he held senior roles at HID Global and Gemalto.
Mike Baxter, on the leadership team since 2010, leads all product management and development across issuance, identity security and data security.
Google’s 2024 distrust of Entrust’s public certificates counts against that record, and Entrust sold the business to Sectigo in January 2025.
| Id | Source | Tier | Accessed |
|---|---|---|---|
| f1 | Wikipedia: Entrust | research | 2026-10-16 |
| f2 | Entrust newsroom: Entrust Datacard becomes Entrust | official | 2026-10-16 |
| f3 | TechCrunch: Entrust buying identity verification startup Onfido | press | 2026-10-16 |
| f4 | Entrust: solutions page | official | 2026-10-16 |
This site is an experimental research aid created by Zeltser Security Corp. All its data gathering and analysis was performed autonomously without human review, and it can contain errors of fact, interpretation, and judgment that a human reviewer might catch.
The analyses are statements of opinion, not statements of fact. Machine analysis produced the scores, summaries, and matrix placements by weighing the public sources each page cites, and reasonable people can weigh the same sources differently. Where a page states a fact, it cites the public source and the date it was checked, and the statement is only as accurate as that source. Unless a profile expressly says otherwise, the analysis involves no hands-on testing and no independent validation of any company's products or services.
Nothing here is professional, security, legal, financial, investment, or purchasing advice, and nothing here is a recommendation to invest in, do business with, or avoid any company. Inclusion of a company is not an endorsement, and absence of a company is not a judgment about it. Reading this site creates no advisory or client relationship. Verify any detail you plan to act on against the vendor's current materials.
The content is provided "as is" and "as available," with all warranties disclaimed, express or implied, including merchantability, fitness for a particular purpose, accuracy, and non-infringement. No entry is warranted to be complete, current, or correct. Companies change, vendors update their claims, sources can be wrong, and automated analysis can misread them.
To the fullest extent permitted by law, the operator, Zeltser Security Corp, is not liable for any damages that arise from using this site or relying on its content, including direct, indirect, incidental, special, and consequential damages and lost profits, even if advised that such damages were possible. If you are dissatisfied with the site or disagree with these terms, your remedy is to stop using it.
Entries link to vendor pages, press coverage, and other external sites that Zeltser Security Corp does not control and is not responsible for. A link is not an affiliation with the destination or an endorsement of it. Product and company names and trademarks are the property of their owners, used here nominatively to identify the companies described. Short quotations from cited sources appear for identification and commentary.
Use, quotation, automated retrieval, and redistribution of the content are governed by the Terms of Use at cybercompanyprofiles.com/terms, which permit personal and internal business use with attribution and prohibit republication and resale.