PP&A designed a voice-of-customer study around seven in-depth interviews, completed in June and July 2025, with security and infrastructure leaders in the United States and the United Kingdom: chief information security officers, directors of cybersecurity operations and architecture, heads of IT and cyber risk, IT operations leaders, a former alliances executive at a security vendor and an independent DevOps consultant, across banking, retail, life sciences, industrial equipment and data services.

The interview guide covered current key management practices and the drivers of key ownership, awareness and perception of automated key provisioning, the operational benefits buyers value, adoption barriers and trust, and the influence of regional regulation, with Europe as a specific probe. The team also asked each interviewee to compare the client's key management stack with the largest competing cloud. PP&A synthesized the interviews into a report structured as an encryption trade-off matrix, a deep dive on customer-managed keys, a competitive comparison, an assessment of the automated feature and a set of strategic implications.

Key management strategy is splitting in two. For regulated and mature enterprises, customer-managed keys are non-negotiable for control, sovereignty and compliance, even at high operational cost, because owning the key makes a provider-side disclosure irrelevant and gives auditors proof of control. Provider-managed keys are the path of least resistance for non-critical data and are rejected for anything sensitive. Customer-managed programs carry heavy burdens of their own: expensive tooling and specialists, manual rotation that can trigger production outages when the wrong key is revoked, latency from external key lookups and full exposure to the availability of an external key manager.

The client's platform and its main competitor came out functionally similar, with the client's external key management seen as slightly more mature and the lead eroding. Both share the same critical weakness: no customer-managed key support for their flagship AI services, which breaks end-to-end encryption for the workloads customers care most about and pushes some to delay AI adoption.

The automated feature earned praise for one job: rotating high-volume, short-lived keys for APIs and auto-scaling services, and giving organizations without dedicated security teams a low-effort way to meet compliance. Mature enterprises with existing key programs rejected it outright because it does not integrate with external key management, offers no kill switch and treats keys as resource attributes rather than a centrally governed policy hierarchy. PP&A recommended that the client win on control by strengthening its control-plane features, solve the multi-cloud problem with a native cross-cloud key management offering, lead the market by securing AI workloads end to end, and reposition the automated feature as a developer velocity and mid-market compliance tool rather than an enterprise security solution.

• --