Thales

payShield Cloud HSM

Thales

Thales payShield Cloud HSM is a subscription-based, 'bare metal' hosted Hardware Security Module (HSM) service designed for securing payment workloads in public cloud environments, including Azure, AWS, and Google Cloud. Launched in August 2023, this offering leverages the robust payShield 10K HSMs to provide secure, real-time cryptographic processing capabilities. It caters to both existing users of payment HSMs and new market entrants seeking hardware-based security. The service supports flexible deployment models, including on-premise, cloud, or hybrid configurations, ensuring consistent HSM functionality and the highest levels of security compliance across all options. Thales manages the physical infrastructure, hosting dedicated payShield 10K HSMs in secure data centers under its control, while users retain full administrative control and exclusive access to their allocated HSMs. This Infrastructure as a Service (IaaS) solution shifts the operational risk to Thales, offering benefits such as flexibility, scalability, future-proofing with access to the latest certified hardware, and improved cash flow through a monthly subscription model. It is certified to PCI HSM v3 and FIPS 140-2 Level 3, with Thales data centers complying with PCI DSS and PCI PIN requirements, ensuring critical data security for payment processing.

SafeNet MobilePASS+

Thales

SafeNet MobilePASS+ is Thales's multi-factor authentication (MFA) application designed for mobile, wearable, and desktop devices, transforming them into secure authenticators. It provides robust authentication through both time-based one-time passcodes (OTP) and single-tap push notifications, enabling secure access to corporate and web-based resources, including cloud applications, VPNs, and security gateways. The solution enhances user convenience by offering a streamlined login experience, supporting biometric authentication (fingerprint or facial recognition) on compatible platforms, and facilitating self-enrollment via QR code activation. SafeNet MobilePASS+ is engineered for broad platform compatibility, including Android, iOS, macOS, Chrome OS, Apple Watch, and Windows devices, allowing organizations to leverage personal devices and reduce hardware token costs. It integrates with Thales SafeNet Trusted Access (STA) for comprehensive identity and access management, offering advanced security features such as FIPS 140-3 compliance, device-bound passkeys for phishing resistance, and continuous risk detection to identify compromised devices.

Thales Luna Network HSMs

Thales

Thales Luna Network Hardware Security Modules (HSMs) are high-assurance, tamper-resistant, network-attached appliances designed to secure sensitive cryptographic keys and accelerate cryptographic operations across diverse environments, including on-premises, virtual, cloud, hybrid, and multi-cloud deployments. These HSMs provide a hardware root of trust for an organization's cryptographic infrastructure, ensuring keys are generated, stored, and protected within their secure confines and never leave the hardware boundary. The latest generation, Luna 8, builds upon the established Luna 7 series, offering enhanced performance, multi-tenant scalability, and crypto-agility. Luna 8 is quantum-ready, featuring native support for NIST-standardized post-quantum cryptography (PQC) algorithms like ML-DSA and ML-KEM, and is designed for FIPS 140-3 Level 3 and Common Criteria certifications. Luna 7 HSMs are already FIPS 140-3 Level 3 validated. The modules support robust key lifecycle management and integrate with a broad ecosystem of applications for use cases such as PKI, code signing, SSL/TLS, database encryption, and blockchain. They offer scalable security through cryptographically isolated partitions, allowing multiple applications or tenants to share a single HSM while maintaining strict separation. Thales Luna Network HSMs are available in models supporting both password authentication (A Series) and multi-factor PED authentication (S Series) to meet varying assurance requirements.

Thales Web Signer

Thales

Thales Web Signer is a digital signature software solution designed to secure internet transactions and documents, primarily for corporate banking and other regulated industries. It enables businesses and end-users to digitally sign documents, files, forms, and transactions presented by web applications, ensuring signer authenticity, data integrity, and non-repudiation. The solution leverages Public Key Infrastructure (PKI) and often integrates with Hardware Security Modules (HSMs) to protect the cryptographic keys central to digital signatures, mitigating risks of compromise. Web Signer supports a 'What You See Is What You Sign' (WYSIWYS) and 'Understand What You Sign' (UWYS) experience, which helps protect against social engineering attacks like Man-in-the-Browser (MitB) by providing a secure display of transaction details before signing. It is actively supported for Windows and macOS operating systems, with Thales recommending migration from its predecessor, eSigner, especially for Windows customers due to the end of support for Internet Explorer. The product receives continuous updates for compatibility with modern web browsers like Chrome, Firefox, and Edge. It is often deployed in conjunction with smart cards and USB tokens to meet compliance requirements, streamline digital processes, and reduce reliance on paper-based signing. Thales also offers virtualized versions of hardware smart cards for digital signing.

Thales Crypto Command Center

Thales

Thales Crypto Command Center (CCC) is a centralized, web-based management platform designed to streamline the provisioning, monitoring, and administration of Thales Luna Hardware Security Modules (HSMs) across on-premises, cloud, and hybrid environments. Functioning as a crypto hypervisor, it facilitates Cryptography as a Service (CaaS) by virtualizing HSM resources, enabling organizations to create and manage pools of high-assurance cryptographic resources. Security administrators can define crypto service templates with predefined HSM capabilities and provision these services on demand. The platform supports consistent security policy enforcement, reduces operational costs through automation and multi-tenancy, and provides comprehensive visibility into HSM appliance status and health via dynamic reporting and monitoring. Recent updates, including versions 4.0 and later, introduced cloud-native deployment using containerization (e.g., Kubernetes, Podman) for improved speed, efficiency, and agility, alongside enhanced high availability for the root of trust. It supports a wide range of Luna Network HSMs and offers both premium and freemium licensing options. The solution ensures cryptographic operations occur securely within the HSM, with strong access controls preventing unauthorized access to sensitive cryptographic material, and does not directly access private keys. Version 4.4 introduced Single Sign-On (SSO) with OpenID Connect and an upgrade to Angular 18 for enhanced performance and reliability.

CipherTrust Data Security Platform

Thales

The Thales CipherTrust Data Security Platform is a comprehensive, data-centric cybersecurity solution designed to discover, classify, protect, and control sensitive data across diverse environments, including on-premises, cloud, and hybrid infrastructures. It unifies critical data security capabilities such as data discovery and classification, encryption, tokenization, and centralized key and secrets management into a single platform. The platform helps organizations mitigate data breach risks, achieve compliance with global privacy regulations (e.g., GDPR, HIPAA, PCI DSS), and secure cloud migrations. Key features include transparent encryption for files, databases, big data, and containers; application-layer data protection; format-preserving encryption; tokenization with dynamic data masking; and robust access controls. CipherTrust Manager, a core component, provides FIPS 140-2/140-3 validated enterprise key management, supporting key lifecycle tasks, multi-cloud key management (including BYOE/BYOK/HYOK), and integration with Hardware Security Modules (HSMs). The platform also offers data risk intelligence, real-time file and database activity monitoring, and a unified management console for streamlined policy enforcement and auditing. It is available in virtual and physical form factors, and increasingly as-a-service offerings (CDSPaaS) for flexible deployment and consumption, including CipherTrust Transparent Encryption (CTE) and CipherTrust Cloud Key Manager (CCKM) as-a-service. Thales continues to release updates for its components, with recent patches for CipherTrust Manager in July/August 2026, and an End of Sale announcement for CipherTrust Manager k160 Mk I in September 2026, indicating active product lifecycle management.

Thales CipherTrust Manager

Thales

Thales CipherTrust Manager is a robust enterprise key management solution forming the central control point of the CipherTrust Data Security Platform. It provides comprehensive lifecycle management for cryptographic keys, secrets, and certificates across diverse environments including on-premises, hybrid, and multi-cloud infrastructures (AWS, Azure, Google Cloud, Oracle Cloud). The platform unifies key management operations with Attribute-Based Access Controls (ABAC), integrating with existing Active Directory and LDAP credentials for granular access and separation of duties. CipherTrust Manager offers high-availability configurations, intelligent key sharing, and detailed, securely signed audit trails for non-repudiation and SIEM integration. It supports a broad encryption ecosystem, managing keys for various Thales and third-party encryption products, including tokenization, application encryption, self-encrypting drives, and KMIP-compliant solutions. Available as virtual (k170v, k470v) and physical appliances (k470, k570), it is built on a micro-services architecture with a RESTful interface for flexible deployment and scalability. The solution supports FIPS 140-2 Level 1-compliant operations for virtual appliances, FIPS 140-2 Level 2/3 for physical appliances, and integrates with FIPS 140-2/3 Level 3 compliant Thales Luna HSMs for a strong root of trust. Recent updates, including versions up to 2.24.0, enhance post-quantum cryptography (PQC) readiness, supporting ML-KEM for TLS communication to protect against 'Harvest Now, Decrypt Later' attacks, and introduce FIPS 140-3 Cryptographic Security Profile enforcement.

SafeNet eToken Fusion Series

Thales

The Thales SafeNet eToken Fusion Series is a line of USB security keys engineered for robust multi-factor authentication (MFA), integrating both FIDO2 and Public Key Infrastructure (PKI) capabilities. This series facilitates phishing-resistant, passwordless authentication for workforce access across diverse digital resources, including Windows sessions and enterprise applications. It supports certificate-based methods and FIDO, enabling organizations to gradually adopt FIDO authentication while maintaining existing PKI use cases for certificate-based authentication, digital signatures, and document encryption. Available in various form factors, such as USB-A and USB-C, and with options for NFC, FIPS 140-2/3, PIV compliance, and biometric fingerprint sensors (e.g., SafeNet eToken Fusion Bio), these tokens enhance security by requiring a physical token, a PIN, and often touch-based presence detection or biometric verification. The series aims to balance high security with user convenience, supporting compliance with security regulations and standards like FIPS 140-2/3, TAA, and eIDAS. The Fusion series is actively sold and supported, with new models like the Fusion Bio being recently launched and integrated with credential management systems.

Data Protection on Demand (DPOD)

Thales

It’s Not Just Data Protection. It’s Data Protection on Demand. The award winning Thales Data Protection on Demand is a cloud-based platform providing a wide range of cloud HSM and key management services through a simple online marketplace. Security is now simpler, more cost effective and easier to manage because there is no hardware to buy, deploy and maintain. Just click and deploy the services you need, provision users, add devices and get usage reporting in minutes. Deploy and manage key management and hardware security module services, on-demand and from the cloud. - Focus on services, not hardware - Deploy in minutes, not days - Purchase only what you need and reduce costs - Protect data anywhere - Real-time reporting and visibility - Easily integrates with existing apps, IT infrastructure & services

payShield 10K HSM

Thales

Thales payShield 10K is a fifth-generation payment Hardware Security Module (HSM) designed to provide robust cryptographic security for the global payment ecosystem. Launched in April 2019 as the direct replacement for the payShield 9000, it remains actively sold and supported, including through its payShield Cloud HSM service for hybrid and cloud deployments. The payShield 10K secures critical payment processes such as transaction processing, sensitive data protection, payment credential issuing (for cards, mobile, wearables, and HCE applications), mobile card acceptance, and payment tokenization. It supports a comprehensive range of functions for leading payment brands (e.g., American Express, Discover, JCB, Mastercard, UnionPay, Visa) and adheres to industry standards including EMVCo, PCI SSC, GlobalPlatform, Multos, and ANSI. Key features encompass advanced cryptographic algorithms (DES, Triple-DES, AES, RSA, ECC), FIPS 140-2 Level 3 and PCI HSM v3 certifications, and enhanced physical tamper protection. The device offers high performance, resilience through dual hot-swappable power supplies and fans, and scalability. Remote management is facilitated via payShield Manager, with monitoring capabilities through payShield Monitor. It is available for on-premises deployment and forms the foundation for the payShield Cloud HSM service, enabling secure, cloud-based payment security solutions with single-tenant control and subscription-based scalability. The payShield 10K is backward compatible at the host interface with its predecessor, offering improved operational efficiencies like lower power consumption and streamlined firmware updates.

payShield Trusted Management Device

Thales

payShield TMD offers secure, flexible and efficient key management for payment HSMs. It is a compact, intuitive, self-contained secure cryptographic device (SCD) that enables you to perform symmetric key management tasks including securely forming keys from separate components or splitting existing keys retrospectively into new components. payShield TMD generates and shares keys in a manner that is compliant with relevant security standards, including X9 TR-31, ANSI X9.24-1 and PCI PIN Security. Unlike traditional approaches, these critical key management tasks can be carried out without any physical connection to a production HSM, providing greater operational flexibility without compromising security. For example, a single payShield TMD can form keys for multiple payment HSMs distributed across multiple data centers, enabling large payment processors to create and distribute thousands of Key Encrypting Keys (KEKs) or Zone Master Keys (ZMKs) in a timely and secure manner while eliminating data entry errors. Each payShield TMD shares one or more Master ZMKs (MZMKs) with the HSMs to facilitate secure exchange of key material. payShield TMD does not require access to the Local Master Keys (LMKs) used by the production HSMs. Keys exchanged between a payShield TMD and an HSM are encrypted under the appropriate MZMK.

Cybels Risk & Threat Evaluation

Thales

Thales Cybels Risk & Threat Evaluation is a comprehensive cybersecurity offering designed to assist organizations in identifying, evaluating, and mitigating potential cyber threats to their infrastructure. It provides a range of solutions and consultancy-led services to ensure security throughout a project's lifecycle, from design to delivery. The offering helps organizations understand their vulnerabilities, assess the effectiveness of their security measures, and improve their overall security posture. Key use cases include identifying cyber risks, evaluating security resilience, enhancing cyber defense capabilities, and ensuring maximum security assurance for new projects and architectures across various sectors. Cybels Risk & Threat Evaluation is targeted at organizations looking to manage cyber risks effectively, achieve digital transformation securely, ensure compliance with industry standards, and optimize cybersecurity investments based on risk and reward. It is part of Thales's broader Cybels solutions portfolio, which encompasses a complete suite of cybersecurity services.

Cybels Detect and Respond

Thales

Thales Cybels Detect and Respond is a suite of cybersecurity products and services designed to provide organizations with advanced threat detection, threat hunting, and incident response capabilities. It aims to reduce the impact of cyberattacks by enabling faster and more exhaustive real-time detection of complex threats. Cybels Detect and Respond leverages artificial intelligence (AI), big data analytics, and machine learning, alongside the expertise of cybersecurity specialists operating in global Security Operations Centers (SOCs) 24/7. The offering includes Endpoint Detection and Response (EDR) as a service, cyber threat intelligence, and monitoring of infrastructure and endpoint events. It caters to various sectors including industry, energy, finance, defense, and healthcare, supporting on-premise, cloud (AWS, Azure, Google Cloud), and OT environments. The solution focuses on proactive defense, continuous monitoring, and rapid response to minimize business disruption and ensure resilience against evolving cyber threats.

Sentinel Rights Management (RMS)

Thales

Sentinel Rights Management (RMS) by Thales is a robust and scalable software licensing and enforcement solution designed for medium to large-scale enterprises and software/device vendors. It provides comprehensive control and visibility over how applications are deployed and utilized across on-premise, cloud, and hybrid environments. The system's core function is to enforce complex license agreements, protect intellectual property, and prevent unauthorized software usage and revenue leakage. Sentinel RMS supports a wide array of flexible licensing models, including concurrent, node-locked, feature-based, and commuter licenses, enabling vendors to adapt to diverse business models and pricing strategies. It integrates robust security mechanisms such as 128-bit AES encryption or RSA-2048 signing to safeguard software binaries and license data against unauthorized access, copying, reverse engineering, and tampering. Beyond protection, Sentinel RMS streamlines operations through automated license fulfillment, activation, and management, and can integrate with entitlement management systems like Sentinel EMS for a unified approach to software monetization. It also offers tools for collecting usage data to provide critical insights into product adoption and compliance, supporting business intelligence and product roadmap decisions.

payShield Trusted Management Device (TMD)

Thales

The Thales payShield Trusted Management Device (TMD) is a compact, self-contained secure cryptographic device (SCD) specifically engineered for the secure and efficient management of symmetric keys, primarily for payment Hardware Security Modules (HSMs). It facilitates critical key management operations, such as generating keys from components, splitting existing keys, and securely sharing them, without requiring a direct physical connection to production HSMs. This enhances operational flexibility and significantly reduces the logistical complexities and security risks associated with traditional key ceremonies. The TMD ensures compliance with stringent security standards, including X9 TR-31, ANSI X9.24-1, and PCI PIN Security. It incorporates a secure touchscreen for sensitive data entry, enforces robust role-based authentication with dual control, and supports various secure key sharing methods such as QR codes, smart cards, and USB tokens to minimize data entry errors and streamline processes. The device features a tamper-responsive physical design that automatically erases sensitive data upon detection of an attack, providing comprehensive physical and logical security for cryptographic key material. It complements remote management solutions like payShield Manager, enabling secure, remote key management across distributed data centers and supporting up to 20 independent cryptographic zones.

SafeNet Authentication Client

Thales

SafeNet Authentication Client (SAC) is a robust middleware solution from Thales designed to manage and facilitate secure identity and access for certificate-based authenticators. It acts as a critical link between applications and Thales's Public Key Infrastructure (PKI) authenticators, including eTokens, SafeNet IDPrime smart cards, SafeNet IDPrime Virtual, and combined PKI/FIDO devices. SAC provides strong two-factor authentication, digital signing capabilities, and disk encryption, enabling organizations to secure network logons, protect data, and manage digital credentials effectively. The client supports a wide array of advanced security applications and is compatible with Windows, macOS, and Linux operating systems, ensuring broad applicability across diverse enterprise environments. It offers features for local administration of devices, customization of security configurations and user interfaces, and maintains full backward compatibility with previous middleware versions and a broad range of certificate-based security applications. Recent updates, such as version 10.9, include support for new hardware authenticators, virtual desktop environments, and critical security enhancements to address vulnerabilities, ensuring ongoing protection against evolving threats. SAC streamlines security operations by allowing the deployment of multiple security applications on a single, unified platform, enhancing overall cybersecurity posture.

Thales Luna Network HSM

Thales

Thales Luna Network Hardware Security Modules (HSMs) are high-assurance, tamper-resistant network appliances designed to safeguard cryptographic keys and accelerate sensitive cryptographic operations across diverse environments, including on-premises, private, public, hybrid, and multi-cloud deployments. The latest generation, Luna 8, builds upon decades of cryptographic expertise, offering a quantum-safe and crypto-agile architecture. It provides native firmware support for NIST-standardized Post-Quantum Cryptography (PQC) algorithms like ML-DSA and ML-KEM, and some models incorporate quantum random number generators (QRNG) for enhanced key entropy, generating quantum-enhanced keys. Luna Network HSMs establish a robust hardware root of trust, protecting the entire lifecycle of cryptographic keys within FIPS 140-3 Level 3 validated confines. They enable organizations to centralize key management, enforce strong separation of duties, and meet stringent compliance requirements such as GDPR, HIPAA, PCI-DSS, and eIDAS. The product supports a wide range of APIs (PKCS#11, Microsoft CAPI/CNG, Java JCA/JCE, REST, Pycryptoki) for broad integration and offers features like secure audit logging, remote management, and high availability for resilient cryptographic infrastructure. Available in various models (e.g., A-Series for password authentication, S-Series for multi-factor PED authentication), Luna Network HSMs deliver market-leading performance and scalability, with Luna 8 being significantly more energy-efficient than its predecessors.

SafeNet Authentication Service Private Cloud Edition

Thales

SafeNet Authentication Service Private Cloud Edition (SAS PCE) is an on-premises multi-factor authentication (MFA) solution from Thales designed to secure access to a broad spectrum of enterprise resources. It provides automated lifecycle administration for users, permissions, and tokens, aiming to reduce IT overhead. The solution supports diverse use cases, including VPNs, VDI, cloud applications, and local network access, integrating with enterprise applications via SAML 2.0, RADIUS, agents, and APIs. SAS PCE offers flexible token options, including hardware, software, and tokenless methods like Push OTP and FIDO authentication, enhancing user convenience while maintaining strong security. Its multi-tier architecture simplifies management across various business units, allowing for policy inheritance and customization. While the cloud-based SafeNet Authentication Service was merged into SafeNet Trusted Access, SAS PCE remains an actively sold and supported on-premises offering, with ongoing updates and release notes available. It also features capabilities for single sign-on (SSO) and phishing-resistant passkeys, unifying authentication across hybrid and on-premises systems.

payShield Monitor

Thales

Thales payShield Monitor is a dedicated Hardware Security Module (HSM) monitoring platform providing 24x7 visibility and operational intelligence for Thales payShield HSMs, including payShield 10K and payShield 9000 (with SNMPv3 enabled), across distributed data centers. It offers real-time tracking of HSM health, performance, and utilization, enabling security and operations teams to proactively identify and address potential issues such as performance bottlenecks, capacity risks, misconfigurations, or suspicious activity. The solution delivers comprehensive data through configurable views, detailed dashboards, and flexible reporting with drill-down analysis to specific cryptographic functions. Key features include instant, role-based alerts via email, SNMP, syslog, or web interface based on user-defined thresholds, and continuous tracking with minute-by-minute utilization statistics. It supports secure segregation of duties with Administrator, Group Manager, and Auditor roles, enhancing security and streamlining administration. The platform also incorporates security features like web server certificate management for client browser authentication and strong password policies. By providing actionable insights and reducing the need for physical HSM access, payShield Monitor helps optimize HSM performance, reduce operational costs, and strengthen security oversight in critical payment infrastructures.

Sentinel Connect

Thales

Sentinel Connect is a cloud-based application by Thales designed to automate and streamline entitlement management across diverse business applications. It integrates with Sentinel EMS (Entitlement Management System) to facilitate automated entitlement transactions and synchronize entitlement data throughout an organization's ecosystem. The solution minimizes integration complexity through pre-built connectors and offers a low-code API for custom integrations, reducing development effort. Key functionalities include configurable rules for onboarding, rapid entitlement validation, and synchronized data for enhanced decision-making. By automating these processes, Sentinel Connect aims to reduce manual errors, accelerate system integration, and decrease the operational costs associated with delivering and managing software entitlements, ultimately supporting flexible monetization strategies and improved customer experiences.

Luna Backup Hardware Security Module

Thales

Luna Backup HSMs are designed to securely backup high-value cryptographic key material for enterprises, financial institutions, and governments. They provide a tamper-evident, intrusion-resistant hardware solution that ensures sensitive cryptographic material remains protected throughout its lifecycle. The modules support remote management and backup capabilities, allowing administrators to securely replicate keys across multiple partitions. With features like an LCD touch screen for status review and multi-factor authentication, they enhance security while maintaining compliance with industry standards

Thales Cybels Portfolio

Thales

Thales Cybels Portfolio is a comprehensive suite of sovereign cybersecurity products and services designed to protect critical information systems and operational technology (OT) environments, primarily for government, defense, and critical national infrastructure sectors. The portfolio encompasses advanced capabilities for cyber monitoring and response, including Cybels Sensor for network detection and response (NDR) and Cybels Analytics for threat detection, hunting, and forensic analysis, leveraging AI and big data. It also features robust data protection through encryption solutions like Cybels VPN for secure remote access and communications, and Cybels KMC (Key Management Center) for the secure lifecycle management of cryptographic keys across various domains such as defense, rail, and space. Thales emphasizes sovereign solutions, ensuring data confidentiality, integrity, and resilience, often with certifications for high-security environments (e.g., ANSSI, NATO, EU). Deployment models are flexible, ranging from on-premise to managed services via Security Operations Centers (SOCs), and the framework supports end-to-end cybersecurity lifecycle management, including advisory, integration, and incident response services. The Cybels offerings are continuously evolving to address emerging threats, including those related to 5G, AI, and post-quantum cryptography, with a strong focus on securing complex environments like space and railway systems.

Cybels Train and Experiment

Thales

Thales' Cybels Train and Experiment is a comprehensive cybersecurity training and simulation platform designed to enhance the skills and preparedness of cybersecurity personnel. It enables teams and individuals to experience and respond to cyber incidents in a safe, realistic, and immersive environment. The platform recreates real-life scenarios by simulating existing networks, including IT and OT infrastructures, allowing users to test new technologies, discover emerging threats, and learn effective protection techniques. Key use cases include hands-on cybersecurity training for various skill levels (from beginners to experts), testing and evaluation of ICT/OT infrastructure resilience, and conducting research, such as malware analysis, in an isolated sandbox environment. Cybels Train and Experiment can be deployed remotely or utilized at Thales' Cyber Labs. It offers pre-packaged content, learning materials, and the necessary software and hardware to assess skill gaps and improve expertise. Target customers include governments, defense organizations, critical infrastructure operators, and other enterprises needing to bolster their cyber defense capabilities.

payShield Manager

Thales

Thales payShield Manager is a secure, browser-based remote management solution specifically engineered for Thales payShield Hardware Security Modules (HSMs), primarily supporting the current generation payShield 10K models, and previously the now end-of-life payShield 9000 series. It enables security teams to centrally manage HSMs deployed across various environments, including on-premises, remote, hybrid, and cloud (such as payShield Cloud HSM). The solution facilitates comprehensive key management, security configuration, and the deployment of software and license updates. Robust access controls are enforced through digital credentials, utilizing GlobalPlatform-compliant smart cards with Thales applets, AES 256-bit session keys, and ECC 521-bit certificates to establish secure connections and encrypt data. payShield Manager supports various operational states, including online, offline, secure, and authorized-state operations, and provides functionalities for Local Master Key (LMK) management, interface settings, and audit trail management. By streamlining HSM operations and reducing the necessity for physical presence in data centers, payShield Manager enhances operational efficiency, minimizes risks, and offers flexibility for managing distributed HSM estates, ensuring continuous availability and compliance with payment security standards.