The reason cryptographic inventories come back incomplete is almost never a single missed scan. It is that cryptography does not live in one place. It lives on network endpoints negotiating TLS, inside source code calling crypto libraries, compiled into binaries, written into configuration and infrastructure-as-code, baked into container images, held in cloud key stores, referenced by directory services, managed by PKI systems, and described in HSM metadata. A discovery approach built for one of those planes finds the cryptography on that plane and silently misses the rest, which is how an estate ends up with a confident-looking inventory that covers a fraction of its real cryptographic footprint.
Multi-plane discovery is the recognition that completeness requires finding cryptography wherever it lives, and that the planes are different enough to demand different techniques. No single method reaches all of them. Probing a network endpoint tells you nothing about a hardcoded key in a binary; parsing source code tells you nothing about what a live service actually negotiates. A platform that aspires to a complete inventory has to run several discovery modes and reconcile their findings into one view, and it has to be honest about which modes are mature capability today and which are the frontier the category is still moving toward.
This post lays out the planes cryptography occupies, the discovery modes that reach them, and the emerging frontier of runtime and passive observation that the strongest discovery approaches are moving toward.
The Certificate Visibility Gap
Typical enterprise: what's tracked vs. what actually exists
Tracking Coverage
Certificates Found by Source
⚠️ In the average mid-market enterprise, less than 15% of certificates have both ownership documentation and expiry monitoring.
The Planes Cryptography Occupies
Before discussing methods, it helps to see the surface area. Cryptography is distributed across planes that have almost nothing in common operationally, and each one is a place an inventory can be blind.
| Plane | What Lives There |
|---|---|
| Network endpoints | Live TLS and SSH configurations as actually negotiated |
| Source code | Crypto library calls and algorithm choices across many languages |
| Binaries | Compiled cryptography in PE, ELF, Mach-O, and JAR formats |
| Configuration and IaC | Cipher suites, key references, and TLS settings in config and infrastructure code |
| Container images | Cryptographic material and libraries layered into images |
| Cloud key stores | Keys and certificates managed by cloud key-management services |
| Directories | Cryptographic attributes and certificates in AD and LDAP |
| PKI systems | Issuing CAs, templates, and the certificates they produce |
| HSM metadata | Hardware-held keys described by their metadata |
The breadth is the point. An asset that is quantum-vulnerable and business-critical is no less dangerous for living in a container image rather than on a network endpoint, but a network-only scanner will never see it. Source-code inspection spans many languages because a single enterprise rarely standardizes on one, and cryptography written in an overlooked language is cryptography the inventory does not have. Completeness is defined by the planes a discovery approach can reach, and every plane it cannot reach is a known blind spot rather than an absence of risk.
Active Discovery: Asking Live Systems What They Negotiate
Active discovery probes running systems and observes what they actually do. It connects to a live endpoint, initiates a handshake, and records the cryptography the system negotiates in practice: the TLS versions and cipher suites a server will accept, the certificate it presents, the SSH algorithms a host offers. This is ground truth about behavior, because it captures what the system really does rather than what a configuration file claims it should do, and configuration and behavior diverge more often than anyone expects.
The strength of active discovery is exactly that it reflects reality. A server may have a hardened configuration on disk and still negotiate a weak cipher because of a default the config did not override, or present an unexpected certificate because of a load-balancer rule no one documented. Active probing catches these because it measures the negotiated outcome. Its limit is equally clear: it only sees what is running and reachable at the moment of the probe, and it says nothing about cryptography that is present in code or binaries but not currently negotiated on a live port. Active discovery is necessary and insufficient, which is why it is one mode among several rather than the whole approach.
Static Discovery: Finding Crypto That Is Not Running
Static discovery inspects artifacts at rest rather than systems in motion. It parses source code to find crypto library calls and algorithm choices, examines compiled binaries across PE, ELF, Mach-O, and JAR formats for embedded cryptography, reads configuration and infrastructure-as-code for cipher settings and key references, and inspects container images for the cryptographic libraries and material layered into them. Where active discovery sees behavior, static discovery sees the cryptography that exists whether or not anything is running it right now.
This reaches the large portion of an estate’s cryptography that active probing cannot. A signing routine compiled into a binary that runs only during a release, an algorithm chosen in source code for a service not currently deployed, a key reference in an infrastructure template waiting to be applied, a library layered into a base image used by a hundred downstream containers, none of these is negotiating anything on a live port, and all of them are real cryptographic assets with real risk. Static discovery is also what makes crypto-agility analysis possible, because knowing that an algorithm is bound in source versus in configuration is exactly the substitutability signal that tells you how hard it will be to change. The combination of active and static discovery, behavior plus artifact, is what a mature discovery capability provides today.
Shadow Cryptography: The Crypto No One Registered
Beyond the cryptography an organization knows it has is the cryptography it does not: the shadow crypto that was never registered, never governed, and often never intended to become permanent. Shadow cryptography discovery is the capability of finding these assets, and it matters because the ungoverned cryptography is frequently the riskiest, precisely because no process is watching it.
Shadow crypto takes recognizable forms:
- Self-signed certificates stood up for a quick fix and never replaced, trusted by nothing but still relied upon by something.
- Private CAs spun up by a team to issue internal certificates outside the central PKI, with their own ungoverned trust.
- Hardcoded trust stores where an application ships its own list of trusted roots that no one audits.
- Embedded keys written directly into code, config, or images, outside any key-management discipline.
- Certificate pinning that hardwires trust to a specific certificate or key, creating a brittle dependency that breaks silently on rotation.
Finding shadow cryptography draws on both active and static discovery, because shadow crypto hides on both planes: a self-signed certificate shows up when a live endpoint is probed, while an embedded key or a hardcoded trust store shows up only under static inspection of code and images. The reason to call it out as its own capability is that shadow crypto is defined by the absence of governance, not by where it lives, and a platform that surfaces it as a distinct category gives an operator the one view that governed-asset tracking can never produce: the cryptography that exists in spite of the process rather than because of it. This is mature capability today, built on the active and static modes already described.
The Emerging Frontier: Passive and Runtime Observation
Active and static discovery, together with shadow-crypto detection, cover the planes an inventory can reach by probing systems and inspecting artifacts. There are two further modes that represent where deep discovery is heading rather than what a platform delivers as settled capability today, and the honest framing keeps them in the frontier category rather than overstating them as present-tense product behavior.
The first is passive network observation. Instead of initiating handshakes, a passive approach watches traffic through a network mirror such as a SPAN port or a tap and infers the cryptography in use from the handshakes it observes, without touching the endpoints at all. The appeal is that it sees cryptography in environments where active probing is unwelcome or impossible, and it catches intermittent or short-lived connections that a point-in-time active scan would miss entirely. This is the direction the strongest discovery approaches are moving toward, because it extends coverage to behavior that neither probing nor static inspection captures.
The second is runtime observation of cryptography as it executes. Rather than reading a binary at rest, a runtime approach would observe cryptographic operations in memory as a process runs, using in-process instrumentation or kernel-level techniques such as eBPF to see which algorithms and keys are actually exercised at execution time. This is the deepest form of discovery in principle, because it captures cryptography that is neither declared in a reachable config nor statically obvious in a binary, and it is correspondingly the hardest to do well. It is best understood as the emerging frontier of the field, the place deep discovery is heading, rather than a capability to claim as delivered today.
Treating these two as frontier rather than finished is not a hedge; it is the accurate picture of where the category stands. The platforms worth trusting are candid about which modes are mature and which are the direction of travel, because an inventory’s credibility rests on not overstating its own reach.
Why the Modes Have to Work Together
The through-line is that completeness is a property of combination, not of any single technique. Active discovery gives behavior on live endpoints. Static discovery gives the cryptography at rest in code, binaries, config, and images. Shadow-crypto detection gives the ungoverned assets that governed tracking misses. Passive and runtime observation point to the coverage the field is still extending into. Each mode reaches planes the others cannot, and each has a blind spot another mode fills. A platform that runs one mode and calls it an inventory has described one plane and ignored the rest.
The practical consequence is that a discovery approach should be evaluated by the planes it reaches and the honesty with which it describes that reach, not by a single headline number of assets found. An inventory that confidently reports a count while blind to entire planes is more dangerous than one that reports a smaller count and names its blind spots, because the first invites decisions built on a false sense of completeness. Multi-plane discovery, run as a coordinated set of modes with clear boundaries between the mature and the emerging, is what makes a cryptographic inventory trustworthy enough to act on.
FAQ
Q: Why does cryptographic discovery need more than one method? Because cryptography lives across planes that have nothing in common operationally: network endpoints, source code, binaries, configuration, container images, cloud key stores, directories, PKI, and HSM metadata. Probing a live endpoint cannot see a key compiled into a binary, and parsing source code cannot see what a running service actually negotiates. Each method reaches some planes and is blind to others, so completeness requires running several and reconciling them.
Q: What is the difference between active and static discovery? Active discovery probes live systems and records the cryptography they actually negotiate, which is ground truth about behavior and catches cases where a system behaves differently from its configuration. Static discovery inspects artifacts at rest, source code, binaries, config and IaC, and container images, and finds cryptography that exists whether or not anything is running it. Behavior plus artifact is what a mature discovery capability provides.
Q: What counts as shadow cryptography? Cryptography that was never registered or governed: self-signed certificates left in place, private CAs spun up outside the central PKI, hardcoded trust stores an application ships for itself, keys embedded directly in code or images, and certificate pinning that hardwires brittle trust. It is defined by the absence of governance rather than by where it lives, and it is often the riskiest cryptography precisely because no process is watching it.
Q: Are passive and runtime discovery things a platform does today? They are best understood as the emerging frontier rather than settled capability. Passive observation watches traffic through a network mirror to infer cryptography without touching endpoints, and runtime observation would watch cryptographic operations in memory as processes execute. These are the directions deep discovery is heading, and a credible platform is candid about which modes are mature and which are still being extended into.
Q: How should I judge whether a discovery approach is complete? By the planes it reaches and the honesty with which it describes its blind spots, not by a single headline count of assets found. An inventory that reports a confident number while blind to entire planes invites decisions built on a false sense of completeness. One that reports a smaller count and names what it cannot yet see is more trustworthy, because it tells you where to keep looking.
About QCecuring
QCecuring runs coordinated active and static discovery across network endpoints, source code in many languages, binaries in PE, ELF, Mach-O, and JAR formats, configuration and IaC, container images, cloud key stores, directories, PKI, and HSM metadata, and surfaces shadow cryptography such as self-signed certificates, private CAs, hardcoded trust stores, and embedded keys as a distinct category. It is candid about passive and runtime observation as the frontier the field is moving toward, so the inventory you act on names its reach honestly.
See how multi-plane discovery changes what your inventory can find
Tags: CBOM, Cryptographic Inventory, Crypto Discovery, Shadow Cryptography, Active Discovery, Static Analysis, Network Scanning, Container Security, Cloud Key Management, PKI, Binary Analysis, eBPF