What counts as an asset
The unit behind every number we publish: how one cryptographic asset is defined, how duplicates collapse, and why a count legitimately changes between runs
On this page — 6 sections
When we say a pilot estate contained 42 cryptographic assets, that number only means something if the word asset has a fixed definition. This article gives it. It also explains why an asset is not the same thing as a finding, and why a count that moves between two runs is usually correct rather than broken.
One asset, defined
An asset is one cryptographic use at one location. Three things have to be true together for a piece of evidence to become an asset: there is a location we can name, there is a primitive in play, and there is a role that primitive is performing at that location.
The location is the part people underestimate. A single certificate presented by four load balancers is not one asset, because remediation happens four times and can fail three of those times. Equally, an endpoint that negotiates one key-exchange group and one signature algorithm is not two assets, because the two are decided together by one configuration and change together.
- Surface
- Which family the evidence came from: endpoint, PKI, source, image, key store, remote access, signing, transport.
- Location
- The most specific stable address available: host and port, repository and path, image digest and layer, key handle, partition and slot.
- Primitive
- The algorithm and its parameters as recorded: family, mode where relevant, key size or curve, hash where the construction names one.
- Role
- What the primitive does here: key establishment, authentication, signing, encryption at rest, integrity, key wrapping.
- Owner
- The team or system of record the location maps to, where your inventory allows that mapping. Unassigned is a valid value and is reported as such.
The asset fingerprint
Each asset gets a fingerprint derived from the canonical form of surface, location, primitive and role. The fingerprint is what makes the inventory comparable over time: if the same use at the same location is found again next quarter, it is the same asset with new evidence, not a new asset.
Owner is excluded from the fingerprint on purpose. Ownership changes for organisational reasons that have nothing to do with cryptography, and an asset should not fork in the inventory because a team was renamed.
Fingerprints are stable, not permanent
Changing the primitive at a location produces a new fingerprint, because the point of migration is that the primitive changed. The old asset is closed with a reason and linked to its successor, so the history reads as one story rather than two disconnected rows.
How duplicates collapse
Most estates generate the same evidence several times over. A certificate appears in a chain, in a key store, in a container trust bundle and in a configuration file. Collapsing that into one asset per real thing is the difference between a count you can act on and a count that flatters the tooling.
| Situation | Rule | Result |
|---|---|---|
| Two detectors report the same primitive at the same location | Collapse to one asset. Both pieces of evidence are attached. | One asset, two evidence records, confidence raised by agreement |
| One certificate served by several distinct endpoints | One asset per endpoint, cross-linked by the shared key identity | Several assets, because remediation is per endpoint |
| A crypto library present in many images built from one base layer | Collapse to the base layer where the layer digest is identical | One asset, with the dependent images listed as affected locations |
| Key-exchange group and signature algorithm on one TLS listener | One asset for the listener, both parameters recorded on it | One asset, not two |
| The same repository path found through two branches | Collapse on the default branch; other branches are recorded as occurrences | One asset, with branch coverage noted |
| Two detectors disagree about the primitive at one location | Do not collapse and do not average. Both are kept and the asset is flagged for review. | One asset carrying an unresolved conflict |
The last row matters more than the others. Averaging a disagreement produces a number that no evidence supports. We would rather hand you an asset marked as contested and let an engineer settle it in ten minutes.
An asset is not a finding
An asset is a fact about your estate. A finding is a judgement about that fact. Discovery produces the first. Scoring produces the second, and the two counts are deliberately different numbers.
| Asset | Finding | |
|---|---|---|
| Produced by | Discovery | Scoring, against the discovered inventory |
| Answers | What cryptography is in use, and where | Why that is a problem, and how much of one |
| Lifecycle | Open until the use at that location changes or is retired | Open until remediated, accepted with a rationale, or withdrawn |
| Cardinality | One per cryptographic use at one location | Zero, one or several per asset |
| Changes when | The estate changes, or coverage changes | The estate changes, or the method version changes |
This is why the pilot figures read as 42 assets and 36 classified vulnerable rather than as a single headline number. One is a census. The other is an assessment, and it can be argued with. Why a specific asset was flagged explains how to argue with it productively.
Why counts change between runs
A moving count is normal. What is not acceptable is a moving count with no explanation, so every run publishes a reconciliation that attributes each change to one of a small number of causes.
- 01The estate changed. A service was deployed, retired, scaled or reconfigured. This is the cause we expect to dominate in a healthy estate.
- 02Coverage changed. A surface that was out of scope last time was collected this time, or a credential expired and a surface went dark. Both directions are reported explicitly.
- 03A detector improved. A newer detector version resolves an algorithm that an older one could only record as unknown. The change is attributed to the detector, with both versions named.
- 04De-duplication resolved. Two assets turned out to be one, or one turned out to be several once a more specific location became available.
- 05A conflict was settled. A contested asset was reviewed and closed one way or the other.
Out of scope
We do not silently restate a previous count. Historic inventories are never rewritten to match a newer detector or a newer method version. If last quarter's report said 42, it still says 42, and the delta is explained in this quarter's reconciliation rather than edited out of the past.
Reading a count honestly
Two questions make any inventory count interpretable, and we answer both on the face of every report. First: which surfaces were in scope. Second: which of those surfaces were actually collected. A count of 42 across eight collected surface families and a count of 42 across three of them are not comparable, and no aggregate number should be allowed to hide the difference.
Treat the count as a floor, not a total. Discovery finds cryptography that is recorded somewhere we were allowed to look. Cryptography that exists only in an operator's memory, in an air-gapped enclave, or inside a third party's platform is not in the number, and the report says so rather than implying completeness.
Every asset traces back to a named detector and the evidence it emitted. The catalogue lists what each one reads, what it produces, and how confident it can honestly be.See the detector catalogue