You Can’t Migrate What You Can’t See

Most organisations cannot answer a deceptively simple question: what cryptography are we actually running? The algorithms, keys, certificates, protocols and crypto libraries that protect an organisation’s data are scattered across source code, configuration files, certificate stores, network services, cloud key managers, hardware security modules and third-party dependencies. Ask ten teams for the definitive list and you get ten partial answers, and not one anyone would put their name to.

For years that was an untidy fact of life rather than an urgent problem. The migration to post-quantum cryptography changes that. You cannot protect, assess or migrate what you cannot see, so the first and unavoidable step is discovery: find every piece of cryptography, and know how far to trust that you found it. This is the problem Physivitis built CETI-VCC to solve.

The problem isn’t finding cryptography; it’s trusting that you found it

It is worth being honest about the state of the field, because it shapes what actually matters. Cryptographic discovery has matured. Multi-source scanning and the ability to export a cryptographic bill of materials are common now, not an edge. Plenty of tools will read your certificates, walk your source code and hand you an inventory.

So the interesting question is not whether cryptography can be discovered. It is whether the inventory you are handed can be trusted. Here most tools share the same quiet weakness: they report whatever they find as fact and lead with completeness. But no scan is ever truly complete. Evidence is uneven, some of it is stale, some of it is duplicated, and no single method reaches every corner of a real estate. A tool that presents its findings as a finished picture is handing you false confidence, and in a migration false confidence is more dangerous than a known gap.

That reframing is the whole point of CETI-VCC. It does the discovery that has become table stakes, and then it does the thing that has not: it tells you how far to trust the result.

The principles behind it

CETI-VCC is built on a few convictions about what an honest discovery tool owes the people who rely on it.

The first is that completeness cannot be promised, so it should be measured instead. Nobody can truthfully hand you a complete inventory of a large, living cryptographic estate. What they can do is tell you how much of that estate the evidence actually touched, and be explicit about where it did not. Coverage becomes an output, not an assumption.

The second is that not all evidence is equal. A finding that a live network handshake confirms is worth more than a single reference buried in an old configuration file. So every finding carries its provenance and a weight, rather than being flattened into a plain list where a solid fact and a weak signal look identical.

The third is that corroboration should count. When two independent sources point at the same cryptographic asset, confidence in that asset should rise. When only one weak source reports it, the finding should stay flagged rather than quietly presented as settled. Trust is something to be earned across evidence, not asserted once.

The fourth is that discovery is a foundation, not an endpoint. An inventory that dead-ends in a report has done only half the job. The same rigour that produced it should carry forward into assessment and migration, so the picture you trust at the start is the picture you act on at the end.

How it works

In practice, CETI-VCC turns evidence from many different sources into a single, verified inventory, then scores how far that inventory can be trusted.

It ingests evidence from across the estate. It parses X.509 certificates down to algorithm, key size and expiry; it scans configuration and source code for cryptographic references; it reads dependency manifests in Java, .NET and Go to see which crypto libraries a project actually declares; it performs real TLS handshakes against live endpoints and records the negotiated protocol, cipher and certificate; it opens and reads keystores, including PKCS#12 and Java keystores; and it normalises in any existing SBOM or CBOM files you already hold.

Everything it finds is classified by quantum status. Assets are sorted into those that are quantum-vulnerable, such as RSA, ECDSA and classic key exchange; those that are adequately hardened, such as sound symmetric cryptography; those already post-quantum, such as ML-KEM and ML-DSA; and hybrids that combine the two. Alongside that, it flags deprecated primitives such as MD5, SHA-1 and DES, which are their own kind of risk regardless of the quantum question.

Then comes the part that makes it more than a scanner. CETI-VCC scores confidence. It weighs each finding by its provenance, raises confidence where independent sources corroborate an asset and holds a finding flagged where only weak evidence supports it, discounts evidence that is stale or duplicated, and rolls the result into an overall discovery-confidence figure adjusted for how much of the estate the evidence genuinely reached. The output tells you not just what cryptography you have, but how far to trust that the picture is complete, and exactly where the gaps are. That is why it is a verified inventory rather than a scan.

What comes out is built to be used, not just read. You get a deduplicated, confidence-scored inventory exportable as a CycloneDX CBOM; a discovery-confidence and coverage figure; a quantum-exposure breakdown; a list of deprecated primitives; a report you can put in front of a board, a regulator or an auditor; and a machine-readable handoff that feeds the next stage of the work.

Where it sits

CETI-VCC is the discover step of a three-part flow. It discovers the inventory; the assessment stage, USMC, works out where you stand from it; and the migration stage, CADRE, plans and carries out the change. Discovery is the foundation the other two build on, which is why it is the entry point. Crucially, the confidence score travels with the inventory, so the rigour established at the start is not lost along the way.

Why it matters now

The timing is not academic. Firm post-quantum deadlines are arriving, reaching beyond government into contractors and critical infrastructure, and a cryptographic bill of materials is increasingly expected on demand as proof of readiness. The market is validated and moving. The question organisations face has shifted from “have you started migrating?” to “show me your inventory, and show me how far to trust it.”

That is the question CETI-VCC is built to answer. Not a scan that claims to be complete, but a verified inventory that is honest about its gaps, and the first, trustworthy step in getting a whole estate ready for what comes next.

You cannot certify, or migrate, what you cannot see; and you cannot defend an inventory you cannot trust.