Topic starter
09/07/2026 3:20 pm
TL;DR: AgileSec 3.6 adds RSA JWT signing, remote token revocation awareness, Tanium Connect ingestion, expanded cloud and source coverage, and improved PQC detection and CBOM export for cryptographic inventory and audit readiness, according to Keyfactor. The release matters because crypto-agility depends on knowing where cryptography exists, not just replacing algorithms later.
Editorial analysis by NHI Mgmt Group, based on content published by Keyfactor: “AgileSec 3.6 Gives Security Teams More Visibility, More Control, and a Faster Path to Cryptographic-Agility”.
Key questions
Q: What breaks when cryptographic assets are only partially visible across cloud and development tools?
A: Partial visibility breaks prioritisation.
Q: Why does token revocation need to be treated as part of identity lifecycle governance?
A: Because a revoked credential that still behaves as valid is a lifecycle failure, not just an authentication detail.
Q: How should security teams evaluate PQC readiness beyond a simple inventory of cryptography?
A: Teams should assess whether the tooling can discover cryptography across the environment and also explain what that cryptography supports.
Practitioner guidance
- Map cryptographic assets into a single inventory Correlate findings from cloud KMS, repositories, runtime tools, and infrastructure scanners so each key, certificate, and token has an owner and a lifecycle state.
- Tie token revocation to access lifecycle events Make remote token revocation awareness part of incident response and offboarding so revoked credentials cannot remain usable through delayed administrative action.
- Use cross-cluster search for cryptographic investigations Query multiple OpenSearch clusters through one workflow when cryptographic findings are spread across regions, environments, or business units.
Bottom line: Cryptographic governance fails when teams can only see part of the environment, because hidden keys, tokens, and certificates cannot be prioritised or controlled.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
09/07/2026 3:38 pm
Cryptographic visibility is now an identity governance problem, not just a security tooling feature. Keys, tokens, certificates, and signing paths increasingly sit inside service authentication and cloud control planes, which means incomplete discovery creates governance blind spots across NHI and workload identity. The release shows that control quality depends on asset visibility first, then policy enforcement. Practitioners should treat cryptographic inventory as part of identity governance architecture.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- 96% of security operations teams report critical blind spots, most commonly in cloud infrastructure (74%) and identity and access behaviour (67%).
A question worth separating out:
Q: Why does SAML role mapping become a governance issue in enterprise identity programmes?
A: Because SAML determines how external identity assertions become internal access decisions. When claim substitution or group mapping is inconsistent, the organisation can unintentionally grant the wrong role, duplicate access paths, or create hard-to-audit exceptions across different identity providers.
👉 Read our full editorial: AgileSec 3.6 expands cryptographic visibility and control