Cryptographic Visibility
Why Most Organizations Don't Know Where Cryptography Lives — And Why It Matters
Most organizations discover 3-10x more cryptographic assets than expected when they start inventorying. Learn why the visibility gap exists and how to close it before PQC migration.
Why Most Organizations Don't Know Where Cryptography Lives — And Why It Matters
Ask a CISO at a mid-market company: "Do you know where RSA is used in your infrastructure?" The honest answer is almost always no.
Not because they are negligent. Because cryptography is everywhere — embedded in TLS certificates, SSH keys, VPN configurations, cloud KMS policies, database encryption settings, application code, third-party APIs, and vendor-managed services. Most of it was deployed over years by different teams with different tools, and no one has ever compiled a unified inventory.
This is the cryptographic visibility gap — and it is the single biggest blocker to PQC readiness. This article explains why the gap exists, what it costs, and how to close it. For related context, see healthcare and financial PQC readiness programs.
Why the Visibility Gap Exists
Cryptography is invisible infrastructure. Unlike a server you can SSH into, or a firewall rule you can query, cryptographic configurations are buried in: For related context, see NIST PQC standards guidance.
- TLS termination points: Load balancers, CDNs, reverse proxies — configured by infrastructure teams who may not document certificate details.
- Application code: crypto.createHmac('sha256', key) buried in a module maintained by a developer who left two years ago.
- Cloud consoles: ACM certificates auto-renewed by AWS with default settings chosen at setup time and never reviewed.
- Vendor platforms: SaaS tools that manage their own certificates. Your procurement team signed the contract. Your security team never saw the cryptographic configuration.
- Legacy systems: Internal applications deployed before certificate lifecycle management tools existed, running with self-signed certificates no one has touched since 2018.
The gap is not a failure of any one team. It is a structural problem: cryptography crosses every domain boundary — infrastructure, application, cloud, vendor, legacy — and no single tool or team has visibility across all of them. For related context, see healthcare PQC readiness planning.
What Organizations Discover When They Start Looking
When organizations run their first cryptographic discovery, the results are consistently surprising:
- 3-10x more certificates than expected. A company that thought it had 50 certificates discovers 300. A company that thought it had 500 discovers 2,000+.
- Expired certificates still in use. 5-15% of discovered certificates are expired — some by years — and still actively serving traffic.
- Forgotten subdomains. Test environments, staging servers, and decommissioned services still have valid TLS certificates pointing to active endpoints.
- Weak algorithms in unexpected places. RSA-1024, SHA-1 signatures, TLS 1.0 — in test environments that accidentally became production dependencies.
- Vendor-managed certificates with no documentation. The marketing website was moved to a new platform, and no one recorded the new TLS configuration.
The Cost of the Visibility Gap
Not knowing where cryptography lives has direct consequences:
Compliance failures: PCI DSS 4.0 requires cryptographic inventory. HIPAA requires encryption risk assessment. DORA requires operational resilience documentation including cryptographic dependencies. Without an inventory, you cannot prove compliance.
Migration paralysis: When NIST or CNSA mandates algorithm migration, you cannot prioritize what you cannot see. Every migration deadline becomes a scramble to discover what needs to change.
Incident response blind spots: A vulnerability in a specific algorithm or library is announced. Without an inventory, you cannot assess impact without manually searching every system.
Board-level credibility gap: When the board asks about quantum readiness, you cannot give a data-driven answer. "We are working on it" is not a substitute for "We have inventoried 347 TLS certificates, of which 82% use RSA-2048, and our migration plan targets Q4 2027."
How to Close the Visibility Gap
Step 1: External Discovery
The fastest starting point. External discovery assesses what is publicly visible — TLS certificates, DNS records, HTTP headers — without touching internal systems. CipherReady automates this: enter a domain, run a scan, and within minutes you have a certificate-by-certificate inventory for your public-facing infrastructure.
This covers the attack surface that auditors, regulators, and attackers can see. For most organizations, this immediately surfaces 50-200% more certificates than expected.
Step 2: Cloud Console Audit
Log into each cloud provider. Export every certificate from ACM, Key Vault, and Certificate Manager. Cross-reference with your external scan — certificates that appear in the cloud console but not in your external scan may be internal-only or misconfigured.
Step 3: CDN and DNS Review
CDNs and DNS providers manage TLS on your behalf. Cloudflare, Fastly, Akamai — each has a certificate configuration dashboard. Export and document.
Step 4: Vendor Inquiry
For every SaaS platform and managed service, ask: "Which TLS certificate protects our data in transit? What algorithm and key size? When does it expire? Who manages renewal?" Document responses. Non-responses are a risk finding.
Step 5: Internal Discovery (Prioritized)
For systems handling regulated or long-lived data, deploy internal scanning tools. This closes the gap for the highest-risk internal assets. External discovery gives you the baseline; internal discovery adds depth for priority systems.
From Gap to Governance
Closing the visibility gap is not a one-time project. It requires ongoing governance:
- Scheduled monitoring: Monthly scans for high-priority domains, quarterly for others
- New domain onboarding: Every new domain gets scanned within 48 hours of creation
- Vendor review cadence: Annual PQC questionnaire for critical vendors
- Board reporting: Quarterly readiness score trend with certificate inventory summary
FAQ
Q: Is the visibility gap worse in larger organizations? A: Generally yes — larger organizations have more domains, more teams, more cloud accounts, and more vendors. But the gap exists at every scale. A 50-person company with 5 SaaS platforms and 10 domains can be just as blind as a 5,000-person enterprise.
Q: How do I convince leadership to invest in crypto visibility? A: Run a free CipherReady scan on your primary domain. Show leadership the results — the number of certificates, the algorithms found, the readiness score. The gap becomes self-evident when they see the data.
Q: Does CipherReady close the full visibility gap? A: CipherReady closes the external layer — the public-facing cryptographic posture that has the broadest attack surface and the highest regulatory visibility. For full internal visibility, CipherReady integrates into a layered discovery strategy complemented by internal scanning tools.
Start Free Readiness Scan →