01 · Discovery & CBOM
You cannot migrate what you cannot see.
Continuous cryptographic discovery across cloud, data center, build pipelines, endpoints, and OT. The output is a versioned cryptographic bill of materials you can hand to an auditor.
The problem
What this stage removes.
Most organizations can name their certificate authorities and still miss the RSA-2048 in a vendor SDK, the ECDSA key in a firmware signing job, and the static Diffie-Hellman in an embedded radio. Inherited cryptography is still cryptography you ship.
Continuous discovery
Agentless connectors for cloud control planes and agent-based collection for data center, endpoint, and OT networks. Scanning runs on a schedule or on change, not once a year.
Dependency and firmware analysis
Inspect build artifacts, container images, package lockfiles, and firmware images for embedded libraries and hard-coded algorithm choices.
CBOM generation
Produce a versioned cryptographic bill of materials in CycloneDX form, with every asset tied to an owner and a business service.
Key and certificate inventory
Locate certificates, keys, and trust stores across CAs, HSMs, KMS, load balancers, and application configuration.
Capabilities
What it actually does.
Capability detail, not marketing categories.
Continuous discovery
Agentless connectors for cloud control planes and agent-based collection for data center, endpoint, and OT networks. Scanning runs on a schedule or on change, not once a year.
Dependency and firmware analysis
Inspect build artifacts, container images, package lockfiles, and firmware images for embedded libraries and hard-coded algorithm choices.
CBOM generation
Produce a versioned cryptographic bill of materials in CycloneDX form, with every asset tied to an owner and a business service.
Key and certificate inventory
Locate certificates, keys, and trust stores across CAs, HSMs, KMS, load balancers, and application configuration.
Data-lifespan tagging
Classify the data each asset protects by how long it must remain confidential — the input that turns a flat inventory into a priority order.
Ownership mapping
Attribute every finding to the team that can actually fix it, and export to the ticketing and SIEM tools they already use.
Output
What you get at the end.
- Versioned CBOM, diffable between runs
- Quantum-vulnerable asset register with owners
- HNDL exposure list by data lifespan
- Evidence export for audit and procurement
Coverage
Where it connects.
- AWS, Azure, Google Cloud
- Kubernetes and container registries
- GitHub Actions, GitLab CI, Jenkins
- HashiCorp Vault, ADCS, EJBCA
- Thales Luna, Entrust nShield, cloud KMS and HSM services
- ServiceNow, Jira, Splunk, Microsoft Sentinel
Services
The work behind the capability.
Platform output only matters if someone acts on it. These engagements deliver the change.
Next step
Find out what you are actually running.
Cipher Posture finds and fixes quantum-vulnerable cryptography. Threat Model Agent models the whole system. Start with the readiness assessment.