AgileSec 3.6 expands cryptographic visibility and control

At a glance

What this is: This is Keyfactor's AgileSec 3.6 update, centred on broader cryptographic discovery, stronger token and access controls, and better reporting for crypto-agility and compliance.

Why it matters: It matters because IAM, PAM, and NHI teams cannot govern machine authentication, certificates, and tokens confidently if cryptographic assets remain partially invisible across clouds, repositories, and runtime systems.

Context

AgileSec 3.6 is a cryptographic visibility and control release that broadens discovery, improves token management, and sharpens reporting for inventory and audit use cases. The primary governance problem is not a lack of algorithms, but a lack of reliable knowledge about where cryptographic assets exist and how they are used.

For identity teams, that makes cryptography an operational governance issue rather than a narrow security setting. Machine authentication, federated access, and cloud workload control all depend on knowing which keys, tokens, certificates, and signing paths are present before policy can be enforced consistently.

Key questions

Q: What breaks when cryptographic assets are only partially visible across cloud and development tools?

A: Partial visibility breaks prioritisation. Teams can discover individual findings, but they cannot reliably tell which keys, tokens, certificates, or signing paths matter most, or which systems depend on them. That means remediation gets delayed, ownership stays unclear, and audit evidence becomes inconsistent across environments.

Q: Why does token revocation need to be treated as part of identity lifecycle governance?

A: Because a revoked credential that still behaves as valid is a lifecycle failure, not just an authentication detail. If revocation state is not reflected consistently across systems, a compromised or departed identity can continue to influence access decisions long after the business has changed the trust relationship.

Q: How should security teams evaluate PQC readiness beyond a simple inventory of cryptography?

A: Teams should assess whether the tooling can discover cryptography across the environment and also explain what that cryptography supports. A useful PQC program needs relationships, not just objects. Inventory alone is incomplete if it cannot map certificates, libraries, algorithms, applications, business services, and ownership well enough to support prioritisation and migration planning.

Q: Why does SAML role mapping become a governance issue in enterprise identity programmes?

A: Because SAML determines how external identity assertions become internal access decisions. When claim substitution or group mapping is inconsistent, the organisation can unintentionally grant the wrong role, duplicate access paths, or create hard-to-audit exceptions across different identity providers.

Technical breakdown

Unified cryptographic discovery across cloud and development systems

AgileSec 3.6 extends discovery into more sources, including Tanium findings, GCP KMS, GitHub, and Bitbucket Data Center. The technical issue is inventory correlation: security teams need cryptographic artefacts from different platforms normalised into one view so that duplicate, stale, or high-risk assets do not disappear inside separate consoles. Cross-cluster search matters because cryptographic risk is usually distributed across regions and business units, not concentrated in one repository. Discovery accuracy also matters because inventory quality sets the ceiling for every downstream control, from remediation to audit reporting.

Practical implication: build a single cryptographic inventory model before you attempt policy enforcement or migration planning.

JWT signing, remote revocation, and SAML controls in machine authentication

RSA JWT signing, remote token revocation awareness, and SAML enhancements address the mechanics of how identities assert trust across systems. JWT signing controls whether tokens are tamper-resistant, revocation awareness determines whether compromised credentials can still be treated as live, and SAML claim handling affects how roles and group membership are translated into access. These controls sit directly on the boundary between authentication and authorisation for workloads, services, and users. When they are fragmented, identity systems can authenticate successfully while still granting stale or excessive trust.

Practical implication: verify that token issuance, revocation, and role mapping are governed as one lifecycle rather than separate admin tasks.

PQC detection and CBOM export turn inventory into migration readiness

Post-quantum cryptography planning fails when teams focus on future algorithms without first understanding current cryptographic exposure. PQC detection helps identify assets that may need remediation later, while CBOM export improves the fidelity of cryptographic records used for governance and audit. The technical value is not just more reporting detail. It is the ability to connect discovery data, cryptographic dependencies, and operational ownership into a form that can support migration sequencing. Without that link, the programme remains reactive instead of planned.

Practical implication: treat PQC readiness as an inventory and dependency exercise, not a one-time algorithm swap.

NHI Mgmt Group analysis

Cryptographic visibility is now an identity governance problem, not just a security tooling feature. Keys, tokens, certificates, and signing paths increasingly sit inside service authentication and cloud control planes, which means incomplete discovery creates governance blind spots across NHI and workload identity. The release shows that control quality depends on asset visibility first, then policy enforcement. Practitioners should treat cryptographic inventory as part of identity governance architecture.

Ephemeral trust debt is the right concept for environments where cryptographic assets outlive their intended context. A token, signing key, or SAML mapping can remain technically valid after the business or operational trust assumption behind it has changed. That creates lingering risk even when the control looks correct on paper. The practitioner conclusion is that lifecycle state matters as much as cryptographic strength.

Crypto-agility collapses if the organisation cannot correlate discovery, ownership, and dependency data. AgileSec 3.6 points to the real operational barrier: migration planning fails when teams cannot see where cryptography is deployed across clouds, repositories, and runtime systems. The field implication is that crypto-agility is a governance discipline, not a late-stage remediation exercise. Teams need inventory fidelity before they can credibly claim readiness.

Machine authentication control must be managed as a unified trust chain. RSA JWT signing, token revocation awareness, and SAML role translation are different layers of the same access path, and gaps between them create stale or excessive trust. That is why identity teams should stop treating token management as separate from cryptographic governance. The practical conclusion is to align machine trust, revocation, and access policy in one operating model.

Cryptographic blast radius: The decisive question is not whether cryptography exists, but how far a compromised key, token, or signing configuration can propagate across connected systems. Broader discovery and better reporting reduce that blast radius by revealing where trust is reused. Practitioners should use that visibility to prioritise the assets whose compromise would affect the widest set of services.

From our research library:

• Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
• 96% of security operations teams report critical blind spots, most commonly in cloud infrastructure (74%) and identity and access behaviour (67%).
• Read next: Cryptographic Key Management Guide

What this signals

Cryptographic inventory is becoming the control plane for crypto-agility. The practical shift is from asking whether strong algorithms are available to asking whether the organisation can actually see every place cryptography is used. That change matters because governance fails when discovery is partial, and partial discovery is still the default in many environments.

Keyfactor's update points to a broader operating model in which identity, cloud, and cryptographic controls converge. Machine authentication, federated access, and runtime trust all depend on consistent lifecycle state, so teams should expect more pressure to align token management, cloud discovery, and audit reporting in one programme.

For practitioners

• Map cryptographic assets into a single inventory Correlate findings from cloud KMS, repositories, runtime tools, and infrastructure scanners so each key, certificate, and token has an owner and a lifecycle state.
• Tie token revocation to access lifecycle events Make remote token revocation awareness part of incident response and offboarding so revoked credentials cannot remain usable through delayed administrative action.
• Use cross-cluster search for cryptographic investigations Query multiple OpenSearch clusters through one workflow when cryptographic findings are spread across regions, environments, or business units.
• Separate SAML claim handling from role design Review claim substitution and multi-group role mapping so identity-based segmentation behaves predictably across enterprise identity providers.
• Build PQC readiness from inventory data Use CBOM export and improved detection output to identify cryptographic assets that will need sequencing, ownership, and remediation planning.

Key takeaways

• Cryptographic governance fails when teams can only see part of the environment, because hidden keys, tokens, and certificates cannot be prioritised or controlled.
• AgileSec 3.6 is framed around visibility, revocation awareness, and reporting fidelity, which are the ingredients needed for crypto-agility and audit readiness.
• Practitioners should treat cryptographic inventory, token lifecycle state, and PQC planning as one connected governance problem rather than separate tasks.

Key terms

• Cryptographic Inventory: A cryptographic inventory is a continuously updated record of keys, certificates, algorithms, libraries and trust anchors across an organisation. It is not a spreadsheet or one-time audit output. In practice, it links each asset to ownership, usage, lifecycle state and risk so teams can make remediation decisions.
• Crypto-Agility: Crypto-agility is the ability to change cryptographic algorithms, certificates, and trust dependencies without redesigning production systems. It matters because cryptographic standards evolve, and organisations need accurate inventories and automated lifecycle controls before they can migrate safely.
• Token Revocation: Token revocation is the ability to invalidate a credential before its natural expiry when it is exposed, misused, or no longer needed. For JWTs and other NHI credentials, revocation closes the gap between detection and continued access, which is essential when a stolen token can otherwise remain usable.
• CBOM: CBOM is a cryptographic bill of materials that inventories algorithms, certificates, protocols, and related crypto assets. It is used to identify weak or outdated cryptography, support policy enforcement, and plan migration to stronger or post-quantum primitives.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.