An inventory tells you what exists. Exposure management tells you what to fix first, who owns it, what replaces it — and proves, scan after scan, that exposure is going down.
Three independent forces have made a cryptographic inventory a board-level migration prerequisite.
FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) shipped in August 2024. The "we're waiting for standards" excuse expired.
DORA, NIS2, and the EU Cyber Resilience Act increase the need for demonstrable ICT resilience, cryptographic governance, and audit-ready evidence — that your existing GRC tooling can ingest.
Data that must stay confidential beyond the years left until 2032 is already inside the harvest-now-decrypt-later window under a 2032 CRQC planning scenario. That is a planning assumption, not a prediction. How HNDL is scored →
One loop, from the first scan to the board report — and every scan after it.
Scheduled and on-demand sources keep the inventory current.
Every asset scored 0–100 from algorithm, key size, data lifetime and HNDL exposure, traced to file and line.
Each finding gets an owner, a replacement and a place in a migration wave.
The next complete scan closes what was fixed and reopens what came back. Nobody resolves a finding by hand.
Snapshots after each scan show whether exposure is going down.
Discovery is useful only if somebody owns the fix.
CRYPTAGION separates today's cryptographic debt from future post-quantum migration candidates, and from the cryptography you should simply keep and monitor. Each finding comes with its recommended replacement.
MD5 · SHA-1 · RSA-1024 · expired certificates
Already broken or out of policy. No quantum computer needed: this is current cryptographic debt, and it goes first.
RSA · ECDSA · ECDH · DH · Ed25519
Sound today, breakable by Shor's algorithm. Sequenced into migration waves towards ML-KEM and ML-DSA by HNDL exposure and data sensitivity.
AES-256 · SHA-256+ · SHA-3 · HMAC
Quantum-resistant at current parameters. Keep it, track it in the inventory and re-check as guidance evolves.
A snapshot after each scan turns migration progress into evidence for security leadership.
ACME Grid demo estate, 6 July → 15 October 2026, three simulated remediation sprints. Fictional data, not a customer result. See the Trend screen →
Sources feed a continuously updated inventory; findings are owned, fixed and verified by the next scan; results reach the tools your teams already use.
Discover, prioritise, plan: the real 1.6.0 dashboard on ACME Grid, a fictional demo estate. See the verified Python case study.
We run it on a public repository — one of yours, or a library your stack depends on. No access to your internal code, and you leave with a real CBOM.
We reply within one business day. · contact@cryptagion.io