Cryptography bill of materials closes visibility gaps in enterprise crypto

At a glance

What this is: This is Sectigo's case for CBOMs as a structured way to inventory cryptographic assets and expose where keys, algorithms and certificates create governance gaps.

Why it matters: It matters because identity, trust and certificate governance all depend on knowing what cryptographic assets exist, where they are used and how quickly they can be replaced when risk changes.

Context

Cryptography only protects identity and data when teams can see where it is deployed, how it is used and what depends on it. In many environments, that visibility is fragmented across certificates, keys, algorithms and the systems that consume them, which leaves governance teams unable to answer basic questions about exposure.

A cryptography bill of materials, or CBOM, addresses that gap by turning cryptographic components into a contextual inventory rather than a static list. For IAM and NHI practitioners, the issue is not just certificate hygiene. It is whether trust dependencies can be governed, remediated and replaced before they fail.

As quantum timelines, algorithm deprecation and compliance pressure intensify, a CBOM becomes a control for crypto agility rather than a documentation exercise. The article frames this as an operational readiness problem: if cryptographic assets cannot be discovered, catalogued and maintained, they cannot be governed.

Key questions

Q: How should teams build a cryptography bill of materials for enterprise systems?

A: Start with discovery across applications, services and devices, then record each key, algorithm and certificate with ownership, purpose, expiration and dependency context. The useful output is not a static list but a governed inventory that shows what cryptographic assets exist, what they protect and what breaks if they change.

Q: Why does a CBOM matter when certificates or algorithms change?

A: Because change is where hidden dependency risk becomes visible. If teams do not know which services rely on a certificate, a key or a deprecated algorithm, they cannot predict outage scope, remediation effort or trust impact. A CBOM makes those dependencies explicit before replacement becomes urgent.

Q: What breaks when cryptographic assets are not mapped to business context?

A: Teams lose the ability to prioritise based on impact. A missing inventory may still let renewal happen, but it will not show which assets protect mission-critical systems, which failures could disrupt trust, or which migrations require extra coordination. That is where cryptographic governance becomes reactive instead of controlled.

Q: What should organisations do first when they discover weak or non-compliant cryptography?

A: Identify the systems that depend on the affected asset, confirm the replacement path, then sequence rotation or migration by business criticality. The first objective is to prevent a trust failure from becoming a service outage, not to treat every asset as equally urgent.

Technical breakdown

What a cryptography bill of materials actually inventories

A CBOM is a structured inventory of cryptographic elements used in systems and software. That includes keys, algorithms, digital certificates, key lengths, expiration dates and the systems that depend on them. The important shift is from counting assets to understanding dependencies: which services use which certificates, which APIs rely on which algorithms and where the trust chain becomes fragile. In practice, that context is what makes crypto governance operational instead of symbolic. Without it, teams may know cryptography exists but still fail to map exposure, ownership or replacement paths when something changes.

Practical implication: Treat CBOMs as dependency maps for trust, not just asset lists.

Why visibility and context matter for certificate governance

Certificate lifecycle management can improve visibility for a subset of cryptographic assets, but it does not by itself explain business criticality, migration constraints or failure impact. A CBOM adds that missing context by linking cryptographic elements to the systems and services they protect. That matters because an expired certificate is not just a technical event. It can interrupt trust relationships, affect service availability and complicate incident response if teams do not know what depends on the affected asset. The governance problem is not only whether an item is present, but whether its operational role is understood well enough to act on it quickly.

Practical implication: Map certificates and keys to business services so remediation can be prioritised by operational impact.

How CBOMs support crypto agility and post-quantum readiness

Crypto agility is the ability to replace or update cryptographic components without breaking the underlying service. A CBOM supports that goal by identifying vulnerable algorithms, weak keys and long-lived digital signatures that may need migration before quantum-era risks or deprecation deadlines arrive. The same inventory also shows where automation can shorten response cycles, especially for rotation, replacement and policy enforcement. For identity and trust programmes, that is crucial: cryptographic change will not be managed well if the estate is opaque. The article's core technical point is that post-quantum readiness starts with knowing what must change, where it lives and what depends on it.

Practical implication: Use CBOM data to rank migration targets by cryptographic weakness and replacement complexity.

Breaches seen in the wild

• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

CBOMs turn cryptographic sprawl into a governable trust surface: The real problem is not the presence of cryptography, but the absence of a reliable way to see how it is deployed across applications, services and certificates. Once trust dependencies are visible, governance moves from assumption to evidence. Practitioners should treat CBOMs as the inventory layer that makes cryptographic accountability possible.

Crypto agility is now an identity and resilience issue, not only a cryptography issue: When certificates, keys and algorithms underpin service trust, delayed replacement becomes an availability and governance risk. That matters to IAM and NHI teams because trust failures affect machine identities as much as user sessions. The implication is that cryptographic lifecycle management must be run as part of broader identity governance, not as a separate technical silo.

Context is the difference between knowing an asset exists and knowing whether it is safe to keep it: A bare inventory cannot tell you which certificates are mission-critical, which algorithms are nearing deprecation, or which dependencies would fail during migration. Sectigo's article is right to push beyond lists toward contextual inventories. That is the level at which enterprise cryptographic governance becomes decision-grade.

Automated remediation becomes essential once cryptographic weakness is visible: Discovery without a replacement path only enlarges the queue of known problems. The governance model has to connect identification, rotation, replacement and policy enforcement so weak or compromised assets do not remain live because of operational inertia. Practitioners should expect CBOM programmes to converge with certificate lifecycle automation.

Post-quantum preparation will expose weak lifecycle discipline before it exposes weak algorithms: The article's quantum framing is important because it shows that readiness depends on asset knowledge, dependency mapping and update speed, not just cryptographic selection. Enterprises that cannot inventory or replace cryptographic assets quickly will struggle with any future migration. The field should read CBOMs as a maturity test for crypto governance.

From our research library:

• Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
• Read next: Ultimate Guide to NHIs — Lifecycle Processes for Managing NHIs

What this signals

Contextual cryptography is becoming a governance baseline: Enterprises can no longer rely on partial certificate views or disconnected renewal processes and still claim crypto control. A CBOM forces the programme to account for dependencies, ownership and replacement paths across the full trust stack.

Lifecycle discipline now matters as much as crypto selection: The article's strongest signal is that inventory, rotation, retirement and replacement need to be managed together. That aligns cryptographic governance with broader identity lifecycle practice, where assets are only safe when their full lifecycle is visible and enforceable.

For practitioners

• Build a cryptographic dependency inventory Catalog every key, algorithm and certificate alongside the applications, services and APIs that depend on it. Include key lengths, expiration dates, ownership and business criticality so the inventory can support operational decisions instead of only audit reporting.
• Link cryptographic assets to service impact Classify each certificate or key by the service it protects and the consequence of failure. This lets teams distinguish routine renewal from assets that can trigger outages, trust failures or regulatory exposure when they change.
• Identify migration blockers early Review which assets are difficult to replace, which algorithms are approaching deprecation and which systems cannot tolerate downtime during rotation. Use that analysis to prioritise remediation by replacement complexity as well as risk.
• Automate rotation and replacement workflows Tie discovery to lifecycle automation so weak, suspicious or compromised certificates can be replaced without relying on manual coordination. The goal is to reduce the time between finding a problem and restoring trusted service.

Key takeaways

• A CBOM is more useful than a list because it shows how cryptographic assets support business systems and where failure would matter most.
• The practical value is in visibility, dependency mapping and remediation speed, especially when certificates or algorithms need to be replaced.
• Enterprises that cannot inventory and maintain cryptographic assets quickly will struggle with crypto agility and post-quantum preparation.

Key terms

• Cryptographic Bill of Materials: A cryptographic bill of materials lists the cryptographic capabilities built into software components, such as supported algorithms and libraries. It is useful for component visibility, but it does not show live configuration, deployment context or actual runtime usage. That makes it a partial input, not the full governance record.
• Crypto-Agility: Crypto-agility is the ability to change cryptographic algorithms, certificates, and trust dependencies without redesigning production systems. It matters because cryptographic standards evolve, and organisations need accurate inventories and automated lifecycle controls before they can migrate safely.
• Certificate Lifecycle Management: The governance of digital certificates from issuance through renewal and revocation, ensuring certificates are valid, monitored, and rotated before expiry. Expired certificates are a leading cause of outages and unplanned security gaps.
• Post-quantum readiness: Post-quantum readiness is the state of preparing identity, cryptographic, and operational controls for a future where quantum computers can break some current public-key algorithms. It includes inventorying vulnerable cryptography, planning migration paths, updating certificates and key management, and ensuring systems can transition without disrupting authentication, trust, or data protection.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.