Documentation

How to read this page

Execution model is the single most important column, because it determines what you must arrange before a sensor can run:

Model	What runs where	What you must arrange
Agent	The discovery agent is delivered to the target and runs there	Delivery credentials (SSH, WinRM, or an endpoint agent platform), and a route back for results
Agentless	The sensor runs on the platform and reaches the target over its own protocol	A network route and a target credential. Nothing is installed on the target.
Cloud	The sensor runs on the platform and calls a provider control plane	Provider API credentials. No machine is touched.

Least privilege. Every sensor is a reader. Where the target platform offers a read-only role, use it — the sensor guides name the specific role or permission set for each. A sensor that is given write access gains nothing from it.

Cloud platforms

Sensor	Targets	Model	Credential	Network
AWS	ACM certificates, IAM server certificates, KMS keys, CloudHSM	Cloud	Access key and secret, or an STS assumed role	443 outbound to the AWS control plane
Azure	Key Vault keys and certificates, Managed HSM, App Service, Application Gateway, Front Door, API Management	Cloud	Entra ID service principal	443 outbound to the Azure control plane
Google Cloud	Cloud KMS, Cloud HSM	Cloud	Service account key	443 outbound to the GCP control plane

Cloud sensors discover one region or subscription per task. Create a task per region for multi-region coverage.

Hardware security modules

Sensor	Targets	Model	Credential	Network
PKCS#11	Thales Luna, Entrust nShield, Utimaco SecurityServer and ESKM, Marvell LiquidSecurity, Securosys Primus, Crypto4A, Atos Trustway Proteccio, IBM CryptoExpress, SoftHSM2, OpenCryptoki, smart-card HSMs, Nitrokey HSM2, YubiHSM2, Feitian ePass, Trustica Cryptoucan	Agent	Partition or slot PIN, read-only role where the vendor offers one	Vendor protocol from the scanning host: Luna 1792, nShield 9004, Utimaco 288. Locally attached devices need no network rule.
KMIP	HashiCorp Vault KMIP, Fortanix DSM, Thales CipherTrust, Cryptomathic CKMS, Entrust KeyControl, Fornetix VaultCore, IBM SKLM and SDS, Townsend AKM, StorageTek OKM3, KEYper Enterprise, QuintessenceLabs qCrypt, Atos Trustway KMS, Eperi Gateway, PrimeKey EJBCA KMIP	Agentless	KMIP client certificate and key	5696

The PKCS#11 sensor needs the vendor's own PKCS#11 library installed on the scanning host. That library is licensed and distributed by the HSM vendor, not by Encryption Consulting, and its presence is the main prerequisite to check before planning HSM discovery.

Discovered from an HSM: key labels, types, sizes, usage flags, extractability, validity dates, and certificate objects. Private key material is never extracted — the point of an HSM is that it cannot be, and the sensor does not attempt it.

Certificate authorities and lifecycle platforms

Sensor	Targets	Model	Credential	Network
AD CS	Microsoft Active Directory Certificate Services	Agent or agentless	Domain account with certificate-read rights	LDAP 389/636, RPC 135 plus the dynamic range
EJBCA	EJBCA PKI	Agentless	REST API credential	443
CertSecure	CertSecure certificate inventory	Agentless	API credential	443

Venafi, Keyfactor and OpenXPKI are covered by their own setup guides in the sensor reference.

Directories

Sensor	Targets	Model	Credential	Network
Active Directory	One or more AD forests, including cross-forest and child domains via Global Catalog	Agentless	Domain account, simple / NTLM / Kerberos bind	LDAP 389, LDAPS 636, Global Catalog 3268/3269
LDAP	Any RFC-compliant directory: OpenLDAP, 389 Directory Server, ApacheDS, OpenDJ, Oracle OUD, FreeIPA, Samba4, NetIQ eDirectory	Agentless	Bind DN and password	389 / 636

Both discover certificates published in the directory — user and computer certificates, CA certificates, and service certificates — along with the directory's own TLS configuration.

Databases

Sensor	Targets	Model	Credential	Network
MSSQL TDE	SQL Server transparent data encryption keys	Agentless	SQL or Windows login with the view-definition rights the guide names	1433
MySQL TDE	MySQL and MariaDB keyring	Agentless	Database account	3306
Oracle TDE	Oracle wallet and TDE master keys, Oracle Key Vault	Agentless	Database account	1521

TDE discovery reports the master key's identity, algorithm and rotation state. It does not read the data encryption keys or any encrypted data.

Secret managers

Sensor	Targets	Model	Credential	Network
HashiCorp Vault	KV, PKI and Transit engines	Agentless	Vault token with read policy	8200

Operating system stores

Sensor	Targets	Model	Credential	Network
Windows Certificate Store	LocalMachine and CurrentUser stores, CNG and CAPI key containers	Agent	Local administrator on the target	None beyond agent delivery
System / Linux trust store	Distribution trust stores, system certificate directories	Agent	Read access to the store paths	None beyond agent delivery
SSH	Host keys, authorized_keys, known_hosts, and the algorithms an endpoint negotiates	Agent or agentless	None for the network probe; file read access for the on-host scan	22
GnuPG	GnuPG keyrings	Agent	Read access to the keyring	None beyond agent delivery

Operating-system trust stores are the largest single contributor to inventory size — roughly 150 certificates per host. Decide deliberately whether to inventory them. Including them gives complete coverage and a much larger inventory; excluding them keeps the inventory focused on material the organisation actually manages. The Sizing Guide quantifies the difference.

Files and keystores

Sensor	Targets	Model	Credential	Network
Files	PEM, DER, PKCS#12 / PFX, JKS, JCEKS, BKS, BCFKS, UBER keystores, and known key-file patterns	Agent	Read access to the scanned paths; keystore passwords where set	None beyond agent delivery
Binary	Compiled artefacts: embedded cryptographic libraries, code signatures, certificate material	Agent	Read access to the scanned paths	None beyond agent delivery

The files sensor takes an explicit path list, a recursion depth and a maximum file size. Point it at the directories that hold managed key material rather than at a filesystem root — an unbounded scan of a large filesystem is slow and returns mostly noise.

Network endpoints

Sensor	Targets	Model	Credential	Network
HTTPS / TLS	Any TLS endpoint: served certificate chain, protocol versions, offered cipher suites	Agentless	None	443 and any operator-specified port
SSH	Any SSH endpoint: banner, key-exchange, host-key, cipher and MAC algorithm lists	Agentless	None	22 and any operator-specified port

These two need no credential at all, which makes them the cheapest way to begin: point them at a subnet and you have a protocol inventory without arranging access to anything.

Source code

Sensor	Targets	Model	Credential	Network
Source code	GitHub, GitLab, Bitbucket, local Git. Languages: C, Go, Java, JavaScript, Python, Rust, TypeScript	Agent or CI	Repository read token	443 or 22 to the repository host

Source-code discovery reports where cryptography is called, not what keys exist. It answers "which code would have to change to move off RSA", which is a different and complementary question to the rest of the inventory. It can also run inside a CI pipeline and gate a build.

What every sensor has in common

Property	Behaviour
Output	Normalised to the same cryptographic material schema, whatever the source.
Private keys	Never extracted, transmitted or stored. Metadata, public keys and fingerprints only.
Failure isolation	A sensor that fails does not abort the others in the same task; the failure is recorded in the run log.
Credentials	Encrypted at rest, masked on every read, never written to a log.
Configuration	Driven by a schema the sensor registers, so the console renders its form without a front-end change.

Choosing where to start

For a first discovery programme, this order gets the most coverage for the least access negotiation:

HTTPS and SSH endpoint scanning. No credentials. Gives a protocol and certificate picture of the network immediately.
Cloud platforms. One service principal per cloud, no machines touched.
Directories and certificate authorities. One read-only account each, wide coverage of issued certificates.
Databases and secret managers. A read account each, targeted at where the organisation knows it holds keys.
Host-level scanning — files, keystores, operating-system stores. The broadest coverage and the largest access-negotiation effort, so it benefits from being informed by everything above.
HSMs. Highest value per key discovered, but needs the vendor library and a partition credential, so plan it as its own piece of work.
Source code. Answers the migration question rather than the inventory question; start it when a migration is actually being planned.

CBOM Secure

Sensor Capability Matrix