Discover
Find cryptographic assets, certificates, keys, algorithms, protocols and embedded dependencies.
The challenge
Cryptography is everywhere. Visibility often is not.
Cryptography protects identities, applications, APIs, infrastructure, transactions, data and communications. Yet it is often distributed across platforms, products, libraries, certificates, keys and third parties with no single view of the full dependency landscape.
When algorithms weaken, standards change, certificates fail or quantum-safe migration becomes necessary, organisations need more than a list of assets. They need ownership, context, prioritisation and the ability to change safely.
A continuous capability
The cryptography resilience journey
Resilience is not a one-time migration project. It is a repeatable operating capability that connects visibility, risk, governance and transformation.
Understand
Add business context, ownership, data sensitivity, exposure and dependency relationships.
Govern
Define policy, standards, accountability, lifecycle controls, exceptions and risk decisions.
Transform
Prioritise remediation, modernise weak cryptography and design for safe, repeatable change.
Resilience
Continuously adapt as technologies, threats, standards and organisational dependencies evolve.
Knowledge areas
Build the foundations before the next migration.
Cryptographic resilience sits at the intersection of technology, governance, architecture and risk. These are the core areas this project explores.
01
Cryptographic Discovery
Inventory cryptographic assets and reveal where cryptography is embedded across the organisation.
Explore topic →02
Dependency Mapping
Understand what systems, services, data flows and business processes depend on each cryptographic mechanism.
Explore topic →03
Cryptography Governance
Establish ownership, policies, standards, decision rights, risk acceptance and lifecycle oversight.
Explore topic →04
Crypto-Agility
Design systems and processes so algorithms, keys and protocols can be replaced without uncontrolled disruption.
Explore topic →05
PKI & Certificates
Connect certificate lifecycle management, trust models and PKI dependencies to the broader resilience strategy.
Explore topic →06
Key Management
Understand how key generation, storage, rotation, access, backup and destruction shape cryptographic risk.
Explore topic →07
Third-Party Dependencies
Identify cryptographic risk inherited through vendors, platforms, libraries, SaaS and supply-chain dependencies.
Explore topic →08
Quantum Readiness
Prepare for post-quantum migration by understanding exposure, prioritising dependencies and building the ability to change.
Explore topic →Free self-assessment
Turn the knowledge into a quick resilience check.
Use 16 focused questions to explore your organisation's cryptography resilience foundations across visibility, governance, agility, PKI, key management, suppliers and quantum readiness.
Immediate indicative resilience profileMaturity and assessment confidence shown separatelyNo registration or company details required
Start the free self-assessment →A separate assessment experience
The assessment is intentionally more structured than the knowledge hub. It is designed to support reflection, evidence gathering and risk conversations — not to replace an audit or formal risk assessment.
Private by design · Answers calculated locally in your browser
Quantum transition
Post-quantum migration is not just an algorithm swap.
Replacing a vulnerable algorithm is only the visible part of the challenge. Organisations first need to know where vulnerable cryptography exists, what depends on it, who owns it, which data requires long-term protection and how change can be coordinated across technology estates and suppliers.
Quantum readiness therefore becomes a test of cryptographic visibility, governance and agility — and a powerful driver for building resilience now.
The core question
How quickly could your organisation identify and safely replace a cryptographic dependency that became unacceptable tomorrow?
Operating model
Cryptographic resilience is a team sport.
No single security function can solve it alone. Sustainable resilience depends on coordinated ownership across technical, risk and business teams.
Information SecurityEnterprise ArchitecturePKIIdentity & AccessApplication DevelopmentInfrastructureCloudRisk & ComplianceProcurementThird-Party RiskData ProtectionBusiness Owners
Methodology
Technically accurate. Risk-focused. Decision-oriented.
The knowledge base is written for Information Security Risk Management and adjacent security-governance audiences. Technical depth is included when it changes a risk decision, while source material is prioritised from authoritative public standards and guidance.
Standards & resources
Grounded in public standards and technical guidance.
This project connects practical cryptography governance to authoritative public sources including NIST, ENISA, IETF and other relevant standards bodies and primary technical guidance. Source references are included throughout the knowledge base.