Who it is for
SaaS companies and SMEs that need a defensible starting point for post-quantum planning but do not yet have a reliable cryptographic inventory.
Crypto inventory / tool-assisted scanner
Find the cryptography your migration depends on
Combine supported repository discovery with a separate review of supplied architecture, vendor, and system evidence. Each evidence source and its limitations are recorded within the agreed scope.
Assessment evidence — based on authorized, supplied, and observable sources
What we need to begin
- A named system owner and written authorization for the agreed scope
- Available architecture, dependency, certificate, and vendor information
- Access to approved exports or repositories without sharing production secrets
- A short list of business-critical systems and long-lived data
What we inspect
- Scanner: supported source API usage and recognized local dependency declarations.
- Separate supplied evidence: certificates, protocol settings, configuration, and runtime observations when available.
- Separate supplied evidence: cloud, identity, PKI, network, and managed-service dependencies.
- Human review: owners, vendor questions, upgrade constraints, and unresolved dependencies.
- Coverage and confidence: record what was analyzed, skipped, or remains unverified.
What you receive
- A scoped cryptographic inventory with source and confidence labels
- An exposure map linking cryptographic use to systems and owners
- A list of evidence gaps, vendor questions, and follow-up actions
- A prioritized handoff into the readiness assessment
How the engagement works
- 01
Authorize
Agree systems, evidence sources, access boundaries, and handling rules before collection.
- 02
Collect
Review approved exports, manifests, configurations, interviews, and tool-assisted observations.
- 03
Validate
Reconcile duplicates, owners, confidence levels, unknowns, and material evidence gaps.
- 04
Prioritize
Identify the systems and questions that should enter a readiness assessment first.
Standards and evidence basis
The inventory records what is observable in the agreed environment and maps findings to current transition references. It is not a certification or proof of complete discovery.
Standards and guidance last reviewed: 5 August 2026.
Final standards
NIST FIPS 203, 204, and 205
Used to identify current standardized post-quantum key-establishment and signature targets.
Final guidanceNIST CSWP 39upd1 — Crypto Agility
Used to frame replaceability, ownership, dependencies, and operational transition constraints.
Initial public draftNIST IR 8547 — PQC Transition
Used only as draft transition context and clearly distinguished from final standards.
Important limitations
- The v0.2.0 scanner analyzes supported source files and recognized local dependency declarations only. It does not scan certificates, runtime, networks, configuration, or cloud environments.
- This is not penetration testing, certification, an SBOM, or a CBOM.
- A point-in-time inventory is limited by the evidence supplied and cannot prove every cryptographic dependency has been found.