Discovery

What is discovery?

Cryptographic discovery identifies certificates, keys, algorithms, protocols, libraries and cryptographic dependencies across code, infrastructure, networks, endpoints and cloud services.

A post-quantum migration plan cannot govern assets it has not found. Breadth matters, but buyers also need evidence about false negatives and the vantage points from which discovery occurred.

Questions to ask a vendor

1. Which asset classes and environments are enumerated?
2. What cannot be observed from the deployed vantage points?
3. Is recall measured against independently constructed ground truth?

What this edition actually supports

Weight 4 of 19. What cryptography can the named product actually find, and on which surfaces?

The review looks for product-specific evidence across source, dependencies, endpoints, networks, certificates, keys and cloud systems. A vendor's inventory claim is evidence of documentation, not proof of complete detection. QScout scores 8 in edition 2026.7; CBOM Secure and SandboxAQ each score 10 on this criterion. Unconnected systems and unknown implementation patterns can remain invisible.

How to investigate this criterion

Open each product's C1 rationale, cited primary pages and the surface-by-surface limits. Ask for a common labelled corpus before claiming superior recall.

Primary and original inputs: pqc-index.org · www.encryptionconsulting.com · api.qtonicquantum.com. Review all dated cell source checks and the 1 October per-cell limits.

The 2026.7 cells below are public-evidence scores. A vendor page documents a claim; an artifact check tests only its stated scope. Missing product execution and inaccessible sources remain explicit unknowns. The score snapshot has not been recomputed from later pages.