TL;DR: Poor cryptographic asset inventory management leaves expired, weak, and shadow assets harder to detect, slows incident response, and complicates PQC readiness, according to Keyfactor. The governance problem is no longer just hygiene: if you cannot inventory keys and certificates, you cannot credibly manage crypto-agility, compliance, or breach containment.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Keyfactor's blog post: Cryptographic asset inventory audits are becoming a PQC governance requirement, because poor inventory visibility undermines crypto-agility, incident response, and compliance.
Why it matters: For IAM and security practitioners, cryptographic inventory is no longer a back-office PKI task because unidentified keys and certificates create governance blind spots that complicate rotation, deprecation, and breach containment.
Context
Cryptographic asset inventory is the record of what keys, certificates, algorithms, and related crypto assets exist, where they are used, and who is responsible for them. When that inventory is incomplete, teams lose the ability to govern expiry, renewal, deprecation, and transition planning with confidence.
The article frames this as a post-quantum cryptography issue, but the governance gap is broader: organisations cannot prepare for algorithm change if they do not know what needs to change. That makes inventory quality a control dependency for PKI operations, compliance, and incident readiness.
Shadow cryptography, expired certificates, and unmanaged keys are not edge cases. They are a typical outcome when crypto assets are allowed to proliferate across teams and tools without continuous discovery and lifecycle oversight.
Key questions
Q: What usually breaks when cryptographic inventory is incomplete?
A: Incomplete inventory breaks prioritisation. Teams cannot tell which systems use which algorithms, which suppliers depend on them, or which assets are too critical to migrate without testing. That creates blind spots in PQC planning and pushes organisations into reactive, high-risk transitions instead of sequenced change.
Q: Why does poor cryptographic inventory create compliance and resilience risk during PQC planning?
A: Poor inventory means organisations cannot prove what cryptographic assets they have, where they are used, or which systems would break during a change. That creates compliance gaps, weakens incident response, and increases the chance of outages during migration. In PQC planning, visibility is not optional because discovery is the control that makes prioritisation and remediation possible.
Q: How should teams handle shadow cryptography in the enterprise?
A: Treat shadow cryptography as an ownership problem first and a technical problem second. Find unmanaged encryption tools, self-signed certificates, and hidden keys, then assign lifecycle responsibility so renewal, revocation, and migration are no longer orphaned.
Q: What should organisations do first before a PQC transition?
A: Start with a complete cryptographic asset inventory, then validate which assets are weak, expired, or business-critical. That gives you a defensible sequence for retirement and replacement instead of trying to modernise everything at once.
Technical breakdown
Why cryptographic inventory becomes a governance control
A cryptographic inventory is more than a list. It is the operational map that connects keys, certificates, algorithms, owners, expiry dates, and business services so that cryptographic change can be governed rather than guessed. In a PQC transition, that map determines which assets need replacement, which protocols depend on legacy algorithms, and where technical debt is hiding. Without it, organisations cannot separate known exposure from unknown exposure. The problem is not just discovery; it is the loss of decision authority over the cryptographic estate.
Practical implication: Treat inventory completeness as a governance prerequisite for any crypto-agility programme.
How shadow cryptography breaks lifecycle oversight
Shadow cryptography appears when teams adopt encryption tooling, self-signed certificates, or third-party services outside central oversight. The result is not only hidden assets but also hidden responsibility, because renewal, revocation, and migration decisions no longer have a clear owner. That matters in identity programmes because cryptographic objects behave like non-human credentials: they authenticate systems, secure trust relationships, and expire on schedules that must be managed. If the inventory misses them, the lifecycle process fails before remediation even starts.
Practical implication: Find and classify unmanaged crypto assets before asking teams to rotate or retire them.
Why PQC readiness depends on crypto-agility
Crypto-agility is the ability to replace algorithms across applications, protocols, hardware, and services without breaking operations. That requires knowing which assets rely on vulnerable cryptography and which business functions would be affected by a transition. Post-quantum migration is therefore not a one-time upgrade project but a change-management problem for the whole cryptographic estate. The inventory becomes the control plane for sequencing migration, identifying exceptions, and avoiding service disruption during algorithm replacement.
Practical implication: Build your PQC transition plan from the inventory outward, not from the algorithm list inward.
Threat narrative
Attacker objective: The attacker seeks to exploit unknown or obsolete cryptographic trust to alter traffic, impersonate systems, or preserve access until the organisation can no longer rely on its crypto controls.
- Entry occurs when weak, expired, or shadow cryptographic assets remain deployed without central visibility, creating hidden trust paths that attackers can target.
- Credential or trust material is then abused when legacy algorithms, stale certificates, or undiscovered keys are used to impersonate systems or tamper with protected traffic.
- Impact follows as service integrity, confidentiality, and recovery confidence degrade because responders cannot quickly identify the affected crypto assets or trust dependencies.
Breaches seen in the wild
- Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
- LastPass breach 2022: An attacker used AWS access keys and decryption keys from a DevOps engineer's corporate vault to copy LastPass customer vault backups.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Cryptographic inventory has crossed from PKI hygiene into governance infrastructure: PQC readiness turns inventory quality into a control dependency, not an administrative nicety. If an organisation cannot answer what cryptographic assets exist, it cannot prove which ones are legacy, shadow, or ready for transition. The practical conclusion is that asset discovery now sits inside identity and trust governance, not beside it.
Shadow cryptography is the cryptographic equivalent of unmanaged non-human identity: once teams deploy encryption outside central oversight, ownership, renewal, and revocation become fragmented. The same governance failure that creates orphaned service accounts also creates orphaned certificates and keys. Practitioners should treat every unknown crypto object as a lifecycle exception, because unknown ownership becomes unknown exposure.
Crypto-agility is only real when change can be sequenced from an accurate inventory: without that inventory, algorithm migration becomes a blind refresh exercise with outages attached. The organisation may believe it is preparing for PQC, but in practice it is only documenting its uncertainty. The practitioner takeaway is to judge readiness by how well the estate can be enumerated, mapped, and reissued.
Expired and weak cryptographic assets create identity trust debt: these assets keep working long after their assurance value has fallen away. That is why inventory audits matter for both security and compliance: they surface trust relationships that have outlived their design assumptions. The field should stop treating certificate and key audits as periodic clean-up and start treating them as assurance of the digital trust layer.
Automated discovery is now the only scalable governance model for cryptographic assets: manual tracking fails because crypto estates change faster than people can record them. Continuous visibility is what allows renewal, migration, and deprecation to happen before outage or audit failure. The implication for practitioners is straightforward: governance that depends on spreadsheets will not survive the PQC transition.
From our research library:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- Read next: Ultimate Guide to NHIs — What are Non-Human Identities
What this signals
Cryptographic asset inventory is becoming a trust-layer governance problem: PQC planning forces teams to confront the difference between what they think they encrypt and what they can actually enumerate. That distinction will shape how confidently they can migrate algorithms, prove compliance, and contain incidents.
Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs: the same visibility gap that affects machine identities also appears in crypto estates, where unmanaged certificates and keys quietly expand risk. Practitioners should assume that poor inventory is a structural issue, not a tooling inconvenience.
For practitioners
- Automate cryptographic asset discovery Continuously enumerate keys, certificates, and algorithm dependencies across applications, infrastructure, and third-party services so the inventory stays current as the estate changes.
- Classify shadow cryptography Create an exception process for self-signed certificates, third-party encryption tools, and unmanaged crypto assets so ownership and renewal responsibilities are assigned.
- Prioritise legacy algorithm retirement Rank assets using SHA-1, RSA-1024, or other obsolete cryptography and schedule replacement before PQC migration work spreads across the estate.
- Tie renewal to service dependency maps Link certificate and key expiry to the business services that depend on them so missed renewals are treated as service-risk events, not admin tasks.
- Build PQC migration from inventory data Use the discovered estate to identify which assets can transition first, where exceptions exist, and which protocols or hardware will need staged replacement.
Key takeaways
- Incomplete cryptographic inventory leaves organisations unable to govern weak, expired, or shadow assets with confidence.
- The article links inventory gaps to higher operational risk, slower incident response, and more difficult PQC migration.
- The practical answer is continuous discovery, ownership assignment, and lifecycle control across the cryptographic estate.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST SP 800-57, NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-07 — Long-Lived Secrets | Expired keys and certificates behave like long-lived cryptographic secrets in this article. |
| NHI-01 — Improper Offboarding | Unmanaged certificates and keys remain active after teams stop tracking them. | |
| Recommendation — Inventory and retire long-lived cryptographic assets before they outlive their trust value. Revoke orphaned certificates and keys when ownership or service responsibility changes. | ||
| NIST SP 800-57 | Part 1 — Key Management Lifecycle | The article centers on key and certificate lifecycle governance for PQC readiness. |
| Recommendation — Use key lifecycle controls to inventory, transition, and retire cryptographic assets on a governed schedule. | ||
| NIST CSF 2.0 | PR.DS-10 — Data-at-rest protected | Cryptographic protection depends on knowing which assets secure data and services. |
| Recommendation — Map cryptographic assets to protected services so data protection remains verifiable during migration. | ||
| CIS Controls v8 | CIS-5 — Account Management | The article's lifecycle and visibility issues mirror broader asset governance gaps. |
| Recommendation — Extend account and asset governance discipline to cryptographic objects that require ownership and review. | ||
Key terms
- Cryptographic Inventory: A cryptographic inventory is a continuously updated record of keys, certificates, algorithms, libraries and trust anchors across an organisation. It is not a spreadsheet or one-time audit output. In practice, it links each asset to ownership, usage, lifecycle state and risk so teams can make remediation decisions.
- Crypto-Agility: Crypto-agility is the ability to change cryptographic algorithms, certificates, and trust dependencies without redesigning production systems. It matters because cryptographic standards evolve, and organisations need accurate inventories and automated lifecycle controls before they can migrate safely.
- Shadow Cryptography: Shadow cryptography is encryption, certificate use, or trust material created outside central governance. It may work technically, but it bypasses the visibility, renewal, and revocation processes that security teams need to manage risk and maintain accountability.
- Post-Quantum Cryptography: Cryptographic algorithms designed to remain secure against attacks from sufficiently powerful quantum computers. In practice, PQC is a migration problem as much as an algorithm problem because organisations must replace trust anchors, certificates, and secrets without breaking identity-dependent systems.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 25, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org