Post-Quantum Readiness

What Is a Cryptographic Inventory and Why Every Enterprise Needs One Before PQC Migration

Learn what a cryptographic inventory is and why it's the first step for post-quantum migration — then scan your domain free to inventory your public TLS, certificates, and algorithms in minutes.

What Is a Cryptographic Inventory and Why Every Enterprise Needs One Before PQC Migration

Ask a security director at any large organization a simple question: "Where does cryptography live in your infrastructure?" Most will not have a complete answer.

They know which firewalls they deploy, which VPN concentrators they run, which certificate authorities issue their TLS certificates. But a comprehensive, searchable, up-to-date inventory of every cryptographic component — algorithms, key sizes, certificates, libraries, protocols, and vendor-managed crypto — rarely exists.

Without a cryptographic inventory, you cannot:

Know whether RSA-2048 is still in use anywhere
Assess the blast radius of a certificate expiration
Answer a regulator who asks about your quantum readiness
Prioritize which systems to migrate first to post-quantum cryptography (PQC)
Prove to your board that you understand your cryptographic risk

A cryptographic inventory is not a compliance checkbox. It is the foundational dataset every organization needs before it can begin its PQC migration.

What a Cryptographic Inventory Includes

A cryptographic inventory is a structured catalog of every cryptographic asset across an organization's infrastructure, applications, and services. It answers five essential questions:

What algorithm is being used? (RSA, ECC, AES, SHA-2, etc.)
What key size is in play? (RSA-2048 vs RSA-4096, ECC P-256 vs P-384)
Where is it deployed? (Which host, service, application, TLS endpoint)
Who manages it? (Internal team, third-party vendor, cloud provider)
How critical is it? (What data does it protect, and what is the blast radius?)

A mature cryptographic inventory includes:

TLS certificate inventory — every certificate, issuer, algorithm, expiry date, SAN entries across all public-facing endpoints
Code-level crypto dependencies — which libraries (OpenSSL, BoringSSL, Bouncy Castle) and algorithms are called in application code
Infrastructure crypto — SSH host keys, VPN cipher suites, database encryption, cloud KMS keys, HSM-resident keys
Vendor-managed crypto — cryptographic components inside SaaS platforms, third-party APIs, managed PKI services
Protocol and configuration data — TLS versions, cipher suites, signature algorithms in active negotiation

Most organizations discover they have far more cryptographic assets than they assumed — often thousands of certificates and dozens of algorithm/key-size combinations.

Why a Crypto Inventory Is the Prerequisite for PQC Migration

NIST published FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA) in 2024. These are the post-quantum cryptographic standards that will eventually replace RSA, ECDSA, and ECDH across most enterprise deployments.

But you cannot migrate what you cannot see.

PQC migration is a per-asset decision process that requires knowing:

Exactly which systems rely on RSA-2048
Which TLS endpoints negotiate ECDHE with P-256
Which X.509 certificates use SHA-256 with RSA signatures
Which third-party services introduce cryptographic dependencies you do not control
Which assets can be upgraded independently and which are tightly coupled

With a cryptographic inventory, you can prioritize by risk, group by dependency, identify vendor blockers, estimate effort, and track progress.

How to Build a Cryptographic Inventory

There are three broad approaches:

External Discovery (Passive, Metadata-Only): Examines publicly visible endpoints — DNS records, TLS handshakes, certificate chains, HTTP headers. Requires no agents, no network changes, no credentials. CipherReady automates this approach.

Network-Based Discovery: Passive monitoring via SPAN/TAP devices inspects encrypted traffic in transit without decryption. Common in PCI-DSS environments.

Host-Based Discovery: Agent or agentless scanning of file systems, key stores, registries, and running processes. Provides deepest visibility but requires broader deployment coordination.

Most organizations should begin with external discovery — it requires zero infrastructure changes and immediately surfaces the public-facing cryptographic posture that auditors, regulators, and attackers can see.

What About CBOM?

A Cryptographic Bill of Materials (CBOM) is the standard format for a cryptographic inventory. Built on the CycloneDX SBOM standard, CBOM captures algorithms, certificates, protocols, and their relationships in a machine-readable format. IBM contributed the initial CBOM specification to CycloneDX 1.6.

A CBOM transforms a cryptographic inventory from a spreadsheet into an interoperable artifact that can feed compliance reports, migration planning tools, and vendor risk assessments.

Getting Started

The first step is the simplest: pick a domain you own, run an external cryptographic posture assessment, and see what surfaces. CipherReady's free tier lets you run up to 3 scans per month. In under 3 minutes, you will have a TLS certificate inventory, DNS exposure summary, HTTP security header review, and a readiness score.

FAQ

Q: How long does it take to build a crypto inventory? A: An external baseline can be completed in hours. A comprehensive internal inventory across all applications, infrastructure, and vendors typically takes weeks to months depending on organizational complexity.

Q: Do I need agents to inventory my cryptographic assets? A: Not for the public-facing surface. External assessment covers TLS certificates, DNS, and HTTP headers without any agents. Internal discovery may benefit from agents for deeper visibility into application code and infrastructure.

Q: How often should I update my crypto inventory? A: At minimum quarterly. Certificates expire, new services come online, and vendors update their configurations. Scheduled monitoring ensures your inventory stays current.

Q: What if I find hundreds of certificates I did not know about? A: That is the most common outcome. The important thing is that you now know about them. Prioritize by risk tier and data sensitivity, then build your migration plan.

Start Free Readiness Scan →

View Sample Report →