ESTATE INVENTORY
Estate Inventory
Most organisations cannot answer the first question a regulator asks: where is cryptography used, and by what. An Estate Inventory answers it from the estate itself rather than from a questionnaire. We read the repositories, pipelines, configuration and certificate stores you nominate, identify the cryptographic assets in them, and score each one under a published method. What you keep is a machine-readable bill of material and a register that names every asset, where it was found, and why it was classified the way it was.
Scope
In scope, and not in scope
In scope
- Source trees and dependency manifests for the repositories you nominate, including cryptographic libraries pulled in transitively.
- Build and release chains: signing steps, container base images, and the toolchains that produce shipped artefacts.
- Configuration as deployed rather than as documented: cipher suite lists, algorithm parameters, protocol versions and library defaults.
- Certificate inventory: leaf and intermediate X.509 material, issuers, key types, key sizes and expiry dates.
- Keys and secrets recorded at the inventory level: which store holds them, under which algorithm, inside which custody boundary.
- Classification and scoring of every asset discovered, with the evidence for each classification retained alongside it.
Not in scope
- Penetration testing and red teaming. We read the estate and describe what is in it; we do not attack it.
- Malware, endpoint detection and response, and host-integrity questions of any kind.
- Source-code correctness review. We locate cryptographic use. We do not review application logic, and a clean inventory is not a statement that the code is sound.
- Identity governance: joiner, mover and leaver process, entitlement review, and access recertification.
- Cloud security posture management and general misconfiguration scanning outside cryptographic settings.
- Anything on a public blockchain and anything custodial. We do not scan addresses, wallets or contracts, and we hold nothing on your behalf.
Surfaces
What we look at
01
Repositories and dependency manifests
Direct and transitive cryptographic dependencies, the versions actually resolved at build time, and the primitives each one exposes to the application above it.
02
Build and release pipelines
Where artefacts are signed, which base images they inherit, and which algorithms the toolchain chooses when nobody has stated a preference.
03
Deployed configuration
Terminator and service configuration read as it runs. Documented intent and deployed reality diverge often enough that we record both and report the gap.
04
Certificates and trust stores
Issuers, chains, key types, key sizes and expiry dates, including internally issued material and trust anchors nobody currently owns.
05
Key and secret stores
KMS and HSM inventories and secrets stores, recorded by algorithm and custody boundary. We record what exists; we never read key material.
06
Inherited and undocumented use
Cryptography that arrived with a vendor appliance, an acquired system or a decommissioned project, and that no current owner will volunteer in a survey.
Scoring
How it is scored
Every asset in the register is scored under the Theos Method across five dimensions: Primitive Fragility, Confidentiality Horizon, Reachability, Change Cost and Substitution Gap. The first three describe how badly a break would land; the last two describe how hard the asset is to replace. Each dimension is derived by deterministic rules from the evidence collected during discovery, so two assessors reading the same estate reach the same figure. The relative weight of each dimension is published on the methodology page and stated only there, so there is exactly one place to check it.
Read the method specificationDeliverables
What you receive
01
Primary artefact
CBOM (CycloneDX)
CycloneDX JSON
A cryptographic bill of material for the assessed scope, structured to sit alongside an existing SBOM pipeline rather than replace it.
02
Exposure Register (CSV)
CSV, one row per asset
Every discovered asset with its location, primitive, classification, score, tier and the detector that found it. This is the working file your owners triage from.
03
Posture Attestation
Signed attestation, reference format
TQ-PA-YYYY-XXXXXXThe signed record that a named scope was assessed on a named date under a named method version. Its reference can be checked at Attestation Lookup by a third party with no access to the estate itself.
04
Evidence Pack
Archive with a
sha256manifestDetector outputs, configuration captures and version metadata behind each finding, hashed so a reviewer can confirm nothing moved between assessment and report.
Evidence
Evidence and reproducibility
Nothing in the register is asserted without a trace behind it. Each row names the detector that produced it, the input it read, and the method version it was scored under, and that version travels with the number into every export. The run is pinned to theos-method-v1.0, so a score can be re-derived later even after the method itself has moved on. If a reviewer wants to reproduce a figure rather than accept it, the procedure is written out in Reproducing our numbers.
Inputs
Inputs and duration
- Duration
- [PLACEHOLDER: engagement duration, Estate Inventory]
- Scope you nominate
- The repositories, environments and certificate authorities in scope, agreed in writing before we begin.
- Access we need
- Read-only access to source, build metadata, deployed configuration and certificate inventories.
- People we need
- One platform or infrastructure owner, one application owner per in-scope system, and whoever holds the certificate inventory today.
- What we never ask for
- Private keys, production credentials, customer data, or write access to anything.
- Handover
- A walkthrough of the register with the owners named above, so triage starts with the people who will do it.
Questions
Questions we are asked
- How complete can an inventory actually be
- Complete for the scope you nominate, and silent outside it. We report coverage explicitly: which repositories, environments and stores were read, and which were not. An asset we never looked at is listed as uncovered, not as safe.
- Do you need to run anything in production
- No. Discovery reads source, build metadata, configuration and inventory data. Where a deployed setting can only be observed from a running service, we read it from a non-production environment or from your own configuration management, and we say which.
- What this engagement will not tell you
- It will not tell you whether your applications are secure. It finds and scores cryptographic use; it does not review logic, test for exploitable defects, or assess controls. It also will not tell you when a quantum computer will break a given primitive, because nobody can date that honestly.
- How does this relate to an SBOM we already produce
- It extends it. The CBOM models cryptographic assets in a CycloneDX shape, so it can be consumed by the tooling already reading your SBOM rather than sitting in a separate silo.
- Can the register be re-run later
- Yes, and the comparison is the point. A second run under the same method version shows which assets changed, which were remediated, and which appeared since the first pass.
Related reading
Three articles that go further
Discuss this engagement
Tell us the estate you have in mind and we will walk through what this engagement would cover, what it would produce, and where its boundary sits. If you would rather put questions in writing first, write to us instead.