Cryptographic discovery
Cryptographic discovery software that finds the crypto you forgot you run
Cryptographic discovery across cloud providers, TLS and CDN endpoints, Kubernetes, host agents, and your own source repositories, consolidated into a cryptographic inventory you can re-run on demand.
Most organisations cannot answer "where do we use cryptography" with a defensible list. Discovery is the stage that closes that gap, and it is the prerequisite for everything else: you cannot migrate what you have not found, and you cannot defend to a regulator what you cannot re-run.
QNSI discovery runs in two modes. Managed connectors inventory what your cloud and network surfaces expose through read-only APIs. A local source scanner finds cryptography embedded in code without any file leaving your environment.
Coverage
What cryptographic discovery finds
Six surfaces, each producing typed inventory assets rather than unstructured findings.
Cloud key management
Keys, aliases, rotation state and algorithm metadata held in AWS KMS, Azure Key Vault, Google Cloud KMS and equivalent services.
Asset records carry provider, region, key identifier and resolved algorithm class.
Certificates and PKI
Certificates from AWS ACM, GCP Certificate Manager, Azure App Service and object stores, including signature algorithm and expiry.
Normalized into the tenant CBOM as certificate assets with algorithm properties.
TLS and CDN endpoints
Negotiated and configured cipher material at load balancers, CloudFront, Cloudflare, Akamai, Fastly and direct probes.
Observed endpoint state recorded with the probe or connector that produced it.
Kubernetes workloads
Secrets, certificate-backed ingress and crypto configuration present in cluster namespaces.
Findings attributed to cluster and namespace rather than to an unattributed host.
Host and runtime agents
On-disk key material, trust stores and process-attached crypto usage observed by the host agent.
Host observations joined to inventory by host identifier.
Source repositories
Cryptographic API and configuration usage in code: RSA, ECDSA, DH, deprecated hashes and ciphers, ML-KEM, ML-DSA, SLH-DSA and hybrid constructions.
Findings reported per file with rule identifier, confidence and line hash; source itself never leaves the environment.
Source-code scanning
Cryptographic discovery inside your repositories
`qnsi crypto scan` reports classical, post-quantum, and hybrid primitives with file, rule, confidence and line-hash evidence.
Runs locally
`qnsi crypto scan ./` reads files without executing them and writes to stdout or a file. No QNSI account or network connection is required to produce a local CBOM projection.
Source stays inside your boundary
File contents and matched source lines are not transmitted. With `--upload`, QNSI receives normalized findings and repository metadata only.
Machine-readable output
Formats: `--format table`, `--format json`, `--format cbom`. Scans can be scoped with `--exclude` and bounded with `--max-findings`.
Honest truncation
If the finding cap is reached the result is explicitly marked truncated, so a partial scan is never mistaken for complete evidence.
Next steps
Where to start
Scanning works without an account; inventory, policy and evidence need a tenant.
What is cryptographic discovery?
Cryptographic discovery is the process of finding every place an organisation uses cryptography: keys, certificates, TLS endpoints, secrets, Kubernetes configuration, and crypto API usage embedded in source code. It produces a defensible answer to 'where do we use cryptography', which is the required first stage of any post-quantum migration.
Can I do cryptographic discovery without uploading source code?
Yes. `qnsi crypto scan` runs locally and emits results only to stdout or a file. Source contents and matched lines are never transmitted; with `--upload`, only normalized findings and repository metadata are sent to QNSI.
What is a cryptographic inventory or CBOM?
A cryptographic inventory records every cryptographic asset and its algorithm properties. QNSI emits this as a CycloneDX 1.5 CBOM, with each component typed as a crypto-asset and classified as post-quantum, hybrid, or classical. The inventory can be signed with a post-quantum signature for tamper evidence.
How do I assess PQC readiness from an inventory?
QNSI summarises the inventory as a PQC readiness percentage derived from the classified components, so the proportion of your crypto surface that is quantum-resistant is a computed figure rather than an assertion. Assessment and migration scope are also available as bounded services.