TL;DR: Cryptographic sprawl now spans cloud KMS, on-premises HSMs, code repositories and file systems, and Fortanix argues that organizations cannot start post-quantum migration until they know where keys, certificates, algorithms and related dependencies live. The governance problem is not algorithm choice alone but incomplete visibility into what cryptography protects and where rotation, policy and remediation will break down.
At a glance
What this is: This is an analysis of cryptographic inventory and why continuous visibility into keys, certificates, algorithms and dependencies is the first step in PQC readiness.
Why it matters: It matters because identity and security teams cannot govern machine identities, certificate lifecycles or crypto-agility if they cannot see where cryptography is embedded across their environment.
Context
Cryptographic inventory is the disciplined record of every key, certificate, algorithm and library in use, plus the systems and data each one protects. Without that baseline, teams cannot judge exposure, prioritise remediation or plan a migration path that survives operational change.
The problem is broader than quantum readiness. Cryptography has accumulated across cloud services, legacy hardware security modules, repositories and runtime environments, creating blind spots that resemble the inventory gaps seen in NHI lifecycle management and other identity governance programmes.
Key questions
Q: What breaks when teams plan PQC migration without a clear cryptographic inventory?
A: A missing cryptographic inventory creates hidden dependency risk. Teams can overlook certificates embedded in applications, unmanaged keys, and legacy systems that still depend on older algorithms. That increases the chance of outages, delayed cutovers, and inconsistent remediation. Effective readiness work depends on knowing what must change, what can be automated, and what needs staged exception handling.
Q: Why does incomplete cryptographic visibility create more risk during quantum transition planning?
A: Because you cannot migrate or retire what you cannot find. Incomplete visibility leaves unknown keys, certificates and algorithms in production, which creates exposure to long-term decryption risk, failed rotations and emergency change windows. Governance fails first when ownership and usage are unclear.
Q: What breaks when cryptographic assets are not mapped to business context?
A: Teams lose the ability to prioritise based on impact. A missing inventory may still let renewal happen, but it will not show which assets protect mission-critical systems, which failures could disrupt trust, or which migrations require extra coordination. That is where cryptographic governance becomes reactive instead of controlled.
Q: When should organisations prioritise cryptographic inventory over algorithm migration?
A: They should prioritise inventory first, because migration plans are only as good as the trust fabric they map. If certificates, keys, service accounts, and workload dependencies are not documented, teams will miss hidden exposure and create outages during replacement. Discovery is the prerequisite control, not a side task.
Technical breakdown
Why cryptographic inventory depends on dependency mapping
A useful cryptographic inventory is not a list of objects, it is a map of relationships. Knowing a key exists is not enough. Teams need to know which applications, services and data the key protects, whether it is hard-coded, where it is stored, when it was rotated, and whether policy controls cover it. That relationship layer is what turns a static catalogue into operational governance. Without it, remediation can break applications, audits become incomplete, and crypto-agility remains aspirational rather than executable. See the NHI Lifecycle Management Guide.
Practical implication: Build inventory around dependency mapping, not isolated asset counts.
How quantum risk changes the meaning of rotation and governance
PQC readiness changes the question from 'is this asset present?' to 'is this asset still safe against future decryption risk?' Cryptographic inventory must classify algorithms, flag vulnerable exposures and show which assets protect long-lived data. That matters because harvest now, decrypt later tactics create a governance debt that grows over time. In practice, inventory becomes the control that tells you which data sets must be protected first and where algorithm migration cannot wait for a routine refresh cycle. Read Post-Quantum Readiness for Identity and PKI.
Practical implication: Use inventory to rank cryptographic assets by long-term confidentiality risk.
What continuous scanning adds to cryptographic governance
Point-in-time discovery is not enough in environments where keys, certificates and libraries change constantly. Continuous scanning closes the gap between creation, deployment and oversight, especially when assets are spread across cloud KMS, databases, repositories and containers. In identity terms, this is the same control logic that underpins lifecycle governance: know what exists, know where it is used, and know when it leaves policy. Continuous visibility is what prevents crypto sprawl from becoming permanent exposure.
Practical implication: Treat continuous discovery as a standing control, not a one-off project.
Threat narrative
Attacker objective: The attacker objective is to preserve access to encrypted data until decryption becomes feasible or governance failures prevent timely remediation.
- Entry occurs when cryptographic assets are created or embedded across cloud services, code repositories, file systems and legacy HSMs without a complete inventory record.
- Credential_harvested maps to exposure of keys, certificates or algorithms that were never catalogued, were hard-coded, or remained outside governance review.
- Escalation happens when unknown assets cannot be rotated, classified or remediated before they become part of a wider quantum or operational exposure window.
- Impact is loss of confidentiality, auditability and migration control, especially for data that must remain protected beyond the quantum transition period.
Breaches seen in the wild
- Google API Keys Exposure — Gemini AI: Google API keys exposed in client-side code via Gemini AI integrations, creating data leak risk.
- Firebase misconfiguration exposure 2024: Missing Firebase security rules on 916 websites exposed 125 million user records and 19.87 million plaintext passwords; a quarter were fixed.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Cryptographic inventory is now an identity governance problem, not just a security hygiene task. The article is right to frame the issue as visibility before migration, because cryptography behaves like a distributed identity estate: it has owners, dependencies, lifecycles and policy boundaries. When teams cannot map those relationships, they cannot govern certificates, keys or algorithm changes with any confidence. Practitioners should treat inventory as the control plane for crypto-agility, not as a spreadsheet exercise.
Harvest now, decrypt later turns unseen cryptography into long-tail exposure. The risk is not limited to future quantum capability. Any encrypted data with long retention periods becomes a governance liability if the supporting algorithms, keys or certificates are not already classified. That makes visibility, retention analysis and remediation priority-setting part of the same problem. Organisations that cannot distinguish short-lived protection from long-lived confidentiality have already lost the planning phase.
Continuous discovery is the only defensible response to cryptographic sprawl. The article correctly rejects point-in-time snapshots because modern environments keep moving, especially across cloud, containers, repositories and external key services. This is where the identity angle becomes concrete: service accounts, workloads and applications often hold the interfaces through which cryptography is created and consumed. Lifecycle governance for NHIs becomes the right analogue for cryptographic assets that must be tracked from creation to retirement.
Crypto-agility fails when ownership and dependency data are missing. The hard part is not deciding that PQC matters, but knowing what can be changed safely, in what order, and with which downstream services affected. That is a governance sequencing issue as much as a technical one. Practitioners should assume that every uncatalogued key or certificate is also an uncatalogued change risk, and plan migration around that uncertainty rather than pretending it does not exist.
From our research library:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- Read next: Ultimate Guide to NHIs — Lifecycle Processes for Managing NHIs
What this signals
Crypto-agility starts with asset visibility, not with algorithm selection. Teams that rush to PQC planning without an inventory will keep inheriting hidden dependencies, because the migration problem is really a governance problem over keys, certificates and the systems they protect.
Cryptographic sprawl mirrors broader identity sprawl. When organisations cannot see where trust lives, they cannot manage lifecycle risk. That is why inventory discipline for cryptography should be treated as part of the same control thinking that governs service accounts, workloads and other identity challenges and risks.
Long-lived data changes the prioritisation model. The article’s central warning is that confidentiality timelines matter more than implementation convenience, so programmes should rank assets by how long they must remain safe rather than by where they are easiest to reach first.
For practitioners
- Implement continuous cryptographic discovery Scan cloud KMS, on-premises HSMs, repositories, file systems and containers on an ongoing basis so new keys, certificates and libraries do not bypass governance.
- Map every cryptographic asset to its dependency chain Record which services, applications and data sets each key or certificate protects so remediation decisions do not break production dependencies.
- Classify assets by quantum exposure and retention need Separate long-lived confidential data from short-lived use cases and prioritise the assets whose compromise would matter after PQC transition windows.
- Eliminate hard-coded cryptographic dependencies Remove embedded keys, algorithm assumptions and unmanaged certificates from source code and build pipelines so upgrades become routine rather than emergency changes.
Key takeaways
- Cryptographic inventory is the control that turns scattered keys, certificates and algorithms into a governed asset base.
- Without dependency mapping, PQC migration creates blind spots, outages and missed remediation priorities.
- Continuous discovery and ownership context are what make crypto-agility and long-term confidentiality planning workable.
Related NHI Mgmt Group resources: NHI Lifecycle Management Guide · Ultimate Guide to NHIs: Lifecycle Processes for Managing NHIs · Post-Quantum Readiness for Identity and PKI
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST SP 800-57, NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | The article centres on hidden cryptographic assets and unmanaged keys that evade inventory. |
| NHI-07 — Long-Lived Secrets | Long-lived keys and certificates drive the PQC exposure window discussed in the article. | |
| Recommendation — Scan for exposed keys and certificates, then revoke or relocate anything outside inventory control. Inventory and prioritise long-lived cryptographic assets for rotation or replacement first. | ||
| NIST SP 800-57 | Part 1 — Key Management Lifecycle | The article is fundamentally about key discovery, governance and lifecycle control. |
| Recommendation — Apply key lifecycle governance so generation, storage, rotation and retirement are tracked end to end. | ||
| NIST CSF 2.0 | PR.DS-10 — Data in transit is protected | Cryptographic inventory supports knowing where protections exist across data flows and protocols. |
| Recommendation — Use data protection controls to confirm that cryptography covers the systems and paths it is meant to protect. | ||
| CIS Controls v8 | CIS-5 — Account Management | The article’s identity angle hinges on knowing which identities and systems own cryptographic assets. |
| Recommendation — Tie cryptographic assets to accountable owners so unmanaged keys do not persist outside oversight. | ||
Key terms
- Cryptographic Inventory: A cryptographic inventory is a continuously updated record of keys, certificates, algorithms, libraries and trust anchors across an organisation. It is not a spreadsheet or one-time audit output. In practice, it links each asset to ownership, usage, lifecycle state and risk so teams can make remediation decisions.
- Crypto-Agility: Crypto-agility is the ability to change cryptographic algorithms, certificates, and trust dependencies without redesigning production systems. It matters because cryptographic standards evolve, and organisations need accurate inventories and automated lifecycle controls before they can migrate safely.
- Harvest now, decrypt later: An attacker strategy where encrypted traffic or stored data is collected today and decrypted later when better computing power becomes available. It matters to NHI governance because machine identities often protect the data paths and secrets most worth preserving over time.
- Key Dependency Mapping: Key dependency mapping identifies which services, applications, workflows and data sets rely on each cryptographic asset. It turns inventory from a catalogue into a control, because teams can only assess blast radius, rotation impact and remediation order when those relationships are explicit.
Deepen your knowledge
The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity and secrets management in a way that helps security teams connect inventory to control. It is relevant for practitioners who need to govern identity-linked cryptography as part of a broader access and lifecycle programme.
Published by the NHIMG editorial team on October 22, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org