01 · Discovery & CBOM
You cannot migrate what you cannot see.
Continuous cryptographic discovery across cloud, data center, build pipelines, endpoints, and OT. The output is a versioned cryptographic bill of materials you can hand to an auditor.
The gap
The gap it closes.
Most organizations can name their certificate authorities and still miss the RSA-2048 in a vendor SDK, the ECDSA key in a firmware signing job, and the static Diffie-Hellman in an embedded radio. Inherited cryptography is still cryptography you ship.
Continuous discovery
Agentless connectors for cloud control planes and agent-based collection for data center, endpoint, and OT networks. Scanning runs on a schedule or on change, not once a year.
Dependency and firmware analysis
Inspect build artifacts, container images, package lockfiles, and firmware images for embedded libraries and hard-coded algorithm choices.
CBOM generation
Produce a versioned cryptographic bill of materials in CycloneDX form, with every asset tied to an owner and a business service.
Key and certificate inventory
Locate certificates, keys, and trust stores across CAs, HSMs, KMS, load balancers, and application configuration.
Capabilities
Built for the work.
The capability behind the outcome — not a feature list.
Continuous discovery
Agentless connectors for cloud control planes and agent-based collection for data center, endpoint, and OT networks. Scanning runs on a schedule or on change, not once a year.
Dependency and firmware analysis
Inspect build artifacts, container images, package lockfiles, and firmware images for embedded libraries and hard-coded algorithm choices.
CBOM generation
Produce a versioned cryptographic bill of materials in CycloneDX form, with every asset tied to an owner and a business service.
Key and certificate inventory
Locate certificates, keys, and trust stores across CAs, HSMs, KMS, load balancers, and application configuration.
Data-lifespan tagging
Classify the data each asset protects by how long it must remain confidential — the input that turns a flat inventory into a priority order.
Ownership mapping
Attribute every finding to the team that can actually fix it, and export to the ticketing and SIEM tools they already use.
Output
What you walk away with.
- Versioned CBOM, diffable between runs
- Quantum-vulnerable asset register with owners
- HNDL exposure list by data lifespan
- Evidence export for audit and procurement
Coverage
Where it fits.
- AWS, Azure, Google Cloud
- Kubernetes and container registries
- GitHub Actions, GitLab CI, Jenkins
- HashiCorp Vault, ADCS, EJBCA
- Thales Luna, Entrust nShield, cloud KMS and HSM services
- ServiceNow, Jira, Splunk, Microsoft Sentinel
Services
When you want us to run it.
Platform output is only useful if it changes the system. These engagements do the work alongside your team.
Next step
Find out what you are actually running.
Cipher Posture finds and fixes quantum-vulnerable cryptography. Threat Model Agent models the whole system. Start with the readiness assessment.