Cryptographic discovery and inventory
CETI-VCC: How it works
PQC Delivery Suite · Discover · Physivitis
A narrated journey through the portal, from selecting evidence sources to a complete verified inventory including the quantum-exposure map and machine-readable handoff. It plays like a video, loops automatically, and you can pause or scrub at any time.
Illustrative walkthrough, not the production tool
Scene 1 of 7 · Select Evidence Sources
The sources you supply determine how much of the estate a discovery pass can see.
Evidence intake · 6 sources supplied
X.509 certificate bundle
Certificates
Application config and source tree
Config and source
Live TLS endpoint sweep, segmented estate
Live endpoints
Keystore set (JKS and PKCS#12)
Keystores
Java, .NET and Go dependency manifests
Dependencies
Existing supplier SBOM
SBOM/CBOM
Every input is captured with its source and its evidence quality. Declared evidence and observed evidence are never treated as the same thing.
Discovery pass complete
One pass reads every source, then cross-checks each finding against the others.
Inventory Summary
CETI-VCC · Illustrative example
Discovery confidence
HIGHSource coverage
6 of 6 supplied sources returned evidence
BROADCorroboration
most findings confirmed by more than one independent source
STRONGQuantum exposure
PRESENTDeprecated primitives
FOUNDFindings by primitive family
TLS key exchange (classical)
CONFIRMEDCertificate signature algorithms
CONFIRMEDSymmetric ciphers in transit
CONFIRMEDLegacy hash in signing chain
CORROBORATEDThird-party library cipher
SINGLE SOURCEKey wrapping in keystores
CONFIRMEDKey insight
Strongest evidence: certificates corroborated by live endpoints. Weakest: one library cipher declared by a manifest and seen nowhere else.
Quantum-exposure map, derived from the verified inventory
Public web estate
classical key exchange
HIGHHarvest-now-decrypt-later risk on long-lived confidential traffic.
Internal service mesh
classical key exchange
HIGHRequires migration to a quantum-resistant key establishment path.
Code signing chain
classical signatures
MEDIUMSignature forgery risk on a long validity horizon.
Data at rest
symmetric encryption
LOWSymmetric strength is materially less affected; key management remains in scope.
Legacy hash usage
deprecated primitive
HIGHDeprecated regardless of quantum timeline; remediate first.
Third-party dependency
cipher declared not observed
UNVERIFIEDCannot be rated until an observed source corroborates it.
Verified Cryptographic Inventory, exported as CycloneDX CBOM
Discover· Assess· MigrateThe verified inventory exports as a machine-readable CBOM and carries straight into assessment and migration.
Inventory Summary
Same flow · A different result
Discovery confidence
LOWSource coverage
1 of 6 sources supplied
NARROWCorroboration
no finding is supported by a second independent source
NONEQuantum exposure
NOT ESTABLISHEDFindings by primitive family
TLS key exchange (classical)
NOT SUPPLIEDCertificate signature algorithms
NOT SUPPLIEDSymmetric ciphers in transit
SINGLE SOURCELegacy hash in signing chain
UNCORROBORATEDThird-party library cipher
SINGLE SOURCEKey wrapping in keystores
UNCORROBORATEDKey insight
Everything here is declared and nothing is observed. Large parts of the estate remain unseen, so this is a claim, not an inventory.
Exposure cannot be mapped from declared evidence alone; supply observed sources to raise confidence.
CETI-VCC will not present an unverified scan as a verified inventory. It shows you exactly what is missing.
One discovery pass. Every source. A verified inventory you can trust.
The sources you supply determine how much of the estate a discovery pass can see.