PHASE 01 — CRYPTO INVENTORY

YOU CAN'T MIGRATE WHAT YOU CAN'T SEE

Most organizations discover, partway into a PQC migration, that they don't know where their cryptography lives. Third-party libraries. Firmware. Old code signers. Protocol upgrades that regressed. The inventory isn't a preamble to the migration — it is the first half of it.

A LIVING CRYPTO CBOM

• 01

  Source code scan

  AST-level scan of every repo: algorithms, parameters, key sizes, deprecated primitives. Wired into CI so drift is caught.

• 02

  Runtime inventory

  Actual TLS handshakes, IKE exchanges, signing operations — observed in production and correlated to the code.

• 03

  Third-party + firmware

  Library SBOMs, appliance firmware signers, HSM algorithm lists, vendor questionnaires.

• 04

  HNDL risk map

  For each asset: confidentiality half-life, adversary interest, harvest-now-decrypt-later exposure. Your migration priority order.