You can’t migrate what you can’t see.
Most organizations have never counted their cryptography. It lives in application code, open-source libraries, TLS terminators, VPNs, HSMs, databases, SaaS integrations and firmware, and nobody owns the full list.
Federal policy now requires it. OMB M-26-15 directs agencies to maintain an automated, continuously updated CBOM, Executive Order 14412 tasks CISA and NIST with CBOM guidance, and PCI DSS 4.0 already asks for an annually reviewed cipher-suite inventory.
What you get
- Full asset inventoryAlgorithms, key sizes, certificates, protocols and libraries, with where each one lives.
- CycloneDX CBOMA standard, machine-readable file your tools and auditors can consume.
- Quantum risk classificationEach asset tagged as vulnerable, weakened or resistant, with an urgency rating.
- Dependency mappingWhich applications and business services depend on which keys and certificates.
- Third-party exposureCryptography inside vendor products and SaaS you can’t change yourself.
- Executive summaryA short readout of what we found and what it means, for non-technical leaders.
The process.
A typical engagement, start to finish. We agree scope and access before any work begins.
- KickoffAgree scope, data classes and access. Read-only throughout.
- ScanAutomated discovery across repos, endpoints, certificate stores and cloud KMS.
- InterviewFill gaps tools can’t reach: HSMs, appliances, partner links.
- ClassifyMap every finding to quantum risk and business owner.
- DeliverCBOM file, findings report and a walkthrough with your team.
Before you ask.
What is a CBOM?
A cryptographic bill of materials is a structured list of every cryptographic asset in a system: algorithms, keys, certificates, protocols and the libraries that implement them. CycloneDX added native CBOM support in version 1.6.
Do you need access to production?
No write access, ever. Most discovery runs from source archives, configuration exports and passive TLS scans. Where we need more, we agree it in writing first.
How is this different from the free scan?
The free scan reads one source archive. A full CBOM covers infrastructure, certificates, vendor products and third-party dependencies, and a cryptographer reviews every finding.
Can we keep the CBOM up to date ourselves?
Yes. We hand over the tooling configuration and a re-scan runbook, or we can run quarterly refreshes for you.