CRYPTAGION goes to the code; the code does not go to CRYPTAGION. Scan inside restricted zones, carry out a signed evidence bundle, analyse and remediate centrally.
Built for energy, defence, industrial, financial and critical-infrastructure estates, where the most sensitive systems sit behind boundaries an external scanner cannot cross.
Your servers, your network, your control. The dashboard, API and workers run where you deploy them.
Fully offline runs are supported. The executive narrative falls back to a deterministic offline mode with no external call.
For zones the central instance cannot reach, the CLI scans inside the zone and writes a signed bundle that an administrator carries out.
The same engine runs as a pipeline gate and emits SARIF and CBOM on every merge.
$ cryptagion scan code --path ./platform --languages java,go $ cryptagion risk score --top 15 $ cryptagion export cbom --output cbom.json $ cryptagion roadmap generate -r dora,nis2,cra $ cryptagion report pdf -o report.pdf
Source code stays where it is. The cryptographic inventory comes out.
For networks the central instance cannot reach — OT, payment enclaves, air-gapped sites — the same CLI scans inside the zone and writes a signed bundle that an administrator carries across. Nothing flows back into the zone.
An illustrative replay using multi-language fixtures — 75 records, with assumed scoring inputs. These are not pyca/cryptography results. Click Run to play it through; to see a live run on a public repository that matches your stack, the first call is free.
Want to see it run live on a public repository that matches your stack? The first call is free. Request a 30-minute demo →
You are inventorying your most sensitive cryptographic assets. You should know exactly who runs the tool, where it runs, and what happens if we disappear. Here are the answers your procurement team will ask for — before they ask.
Discovery runs inside your environment. Static analysis, cert parsing and TLS handshakes execute locally; only the findings are aggregated. The executive narrative is policy-generated; optional LLM assistance uses an EU-sovereign backend you can swap, or runs in a deterministic offline mode with no external call at all. Air-gapped runs are supported.
Every deliverable is an open standard: a CycloneDX 1.6 CBOM your GRC tooling already ingests, and a PDF your board can read without our platform. If you ever stop working with us, your inventory, your roadmap and your audit trail stay fully usable.
Source-code escrow available on Platform engagements, with a documented right-to-audit and a reversibility clause. The offline fallback means a run never depends on our availability. You are buying a deliverable and a method — not a dependency.
CRYPTAGION is built by a focused security-engineering practice — cybersecurity, data & AI specialists with 10 years across banking, luxury and industrial enterprises, where cryptographic risk and regulatory pressure are operational, not theoretical. The people who scope your engagement are the people who run the tool against your code.
We run it on a public repository — one of yours, or a library your stack depends on. No access to your internal code, and you leave with a real CBOM.
We reply within one business day. · contact@cryptagion.io