Cryptographic Inventory

Identify observed cryptographic assets, understand exposure and prepare the transition to quantum-resistant mechanisms.

1. Purpose

Cryptographic Inventory extends the traditional certificate inventory with technical information used to understand the cryptographic mechanisms actually observed within the organization scope.

It helps identify classical, hybrid and post-quantum assets as well as assets that require review because of cryptographic weakness or elevated risk.

2. Cryptographic assets

The Cryptographic Assets view exposes technical information associated with certificates and available network observations.

Depending on collected evidence, an asset may include:

• observed cryptographic algorithms;
• public-key type and size;
• observed TLS protocols;
• cipher suites;
• network observation context;
• post-quantum classification;
• calculated risk level;
• associated findings.

3. The 12 indicators

The Asset List provides twelve summary cards:

• Total certificates;
• Post-quantum;
• Hybrids;
• Weak keys;
• Obsolete protocols;
• Observed endpoints;
• Quantum-vulnerable;
• Quantum-resistant;
• Low risk;
• Medium risk;
• High risk;
• Critical risk.

Each indicator can be selected to filter the asset list to the corresponding category.

4. Classical, hybrid and post-quantum

Ecurem CLM classifies cryptographic mechanisms according to the available technical evidence:

• Classical: traditional cryptographic mechanisms.
• Hybrid: combinations of classical and post-quantum mechanisms.
• Post-quantum: mechanisms using primitives designed to resist known quantum attacks.

The platform also distinguishes quantum-vulnerable and quantum-resistant assets when the available evidence supports that conclusion.

5. Filters and search

Summary cards can be selected to quickly filter the visible assets.

Advanced search can combine several terms:

• different terms are combined using AND logic;
• for each individual term, multiple searchable fields are evaluated using OR logic.

6. Evidence and unknown state

Classification depends on information actually collected. Some assets may therefore remain unknown or undetermined when sufficient evidence is not available.

7. Discovery integration

Network/TLS Discovery can enrich Cryptographic Inventory with services, certificates and TLS characteristics observed within an authorized scope.

Inside internal networks, Discovery Agent extends this collection. When local cryptographic discovery is enabled, the Agent produces a CycloneDX 1.7 CBOM, sanitizes sensitive metadata and submits it to Ecurem CLM. The server validates and normalizes received components into the organization’s Cryptographic Inventory.

Certificate/TLS scanning and local cryptographic collection remain separate processes: a CBOM problem does not invalidate an already completed TLS scan.

See Discovery. · See Discovery Agent.

8. Reports integration

Available cryptographic evidence can be used by compliance and reporting capabilities to produce assessments, findings and supporting evidence.

See Reports & compliance.

9. Enterprise availability

In an Enterprise edition, some cryptographic capabilities may depend on activation by the platform administrator for the relevant organization.

If a capability is unavailable for your organization, contact your platform administrator.

10. Recommended workflow

1. Define the authorized asset scope.
2. Use Discovery to collect available observations.
3. Open Cryptographic Inventory.
4. Review summary cards and filters.
5. Identify quantum-vulnerable or high-risk assets.
6. Review available evidence before drawing a conclusion.
7. Use Reports to document assessments and remediation.