CBOM Secure
CBOM Secure builds and maintains a Cryptographic Bill of Materials (CBOM): a living inventory of every key, certificate, protocol, cryptographic library and crypto call in your organisation. It covers servers, cloud accounts, HSMs, databases, directories, applications and source code.
It scores how risky each item is, checks it against the policies and standards you hold yourself to, and shows what needs to change to be ready for post-quantum cryptography. It then turns the findings into work someone owns.
What CBOM Secure Does
| Capability | What it gives you |
|---|---|
| Discover | Sensors find cryptographic material wherever it lives. They cover cloud key services (AWS, Azure, Google Cloud), HSMs and key managers (PKCS#11, KMIP, HashiCorp Vault), Active Directory, LDAP and certificate authorities, and TLS and SSH endpoints. They also cover database encryption keys, files and keystores, Windows certificate stores, executables, and source code. Sensors run on the hosts you deploy them to, from the CBOM server against cloud and network services, or off-grid, with the results imported later. |
| Inventory | Every finding is normalised into one inventory and de-duplicated, so the same key seen on ten hosts is one item with ten locations. Each item keeps its history, and tags let you slice the estate by business unit, environment or anything else. |
| Track | Every item has a lifecycle. CBOM Secure records when it first appeared, each time a scan saw it changed, when it stopped being seen and was resolved, and when it came back. You can see what your estate looked like on any past date, not just today. |
| Analyse | Each item is scored for risk and for quantum safety. Dashboards and reports show the state of the estate: weak and expiring material, crypto-agility by host, cipher suites in use, and how all of it changes over time. Tag scopes focus any of these views on one region, business unit, classification or owner. |
| Govern | Policies state which algorithms and sizes are acceptable, built from your own rules or from standards such as NIST SP 800, PCI DSS and GDPR. Every item is checked for pass or fail against them. |
| Act | Notification rules raise cases for findings that need attention. They deliver them to the CBOM Secure inbox, email, Microsoft Teams, Jira or ServiceNow, and track each case until it is resolved. |
| Report and export | Summary and PQC reports export to PDF, and the inventory exports as a CycloneDX CBOM. An AI query assistant answers questions about your inventory in plain English. |
| Audit | Every change is recorded with who made it and the roles they held. Access is controlled per permission, and service logs are searchable in one place. |
How It Works
-
Define where to look. Register the hosts to scan, and build a template that chooses the sensors and their settings.
-
Run discovery. A task deploys the template to its hosts, or to cloud accounts. The sensors report what they find back to CBOM Secure.
-
Review the inventory. Findings appear on the dashboards and in the Crypto Inventory and Reports pages, scored and de-duplicated.
-
Set the rules. Policies decide what passes. Notification rules decide what needs action, and who is told.
-
Keep it current. Scheduled tasks re-scan the estate. Material that changes or disappears is tracked, and cases close when their findings are fixed.
Tracking the Inventory and Each Item's Lifecycle
The inventory is not a snapshot. Each scan updates it, and every key, certificate, protocol endpoint and finding keeps a timeline of its own:
Discovered: The item is seen for the first time and joins the inventory.
-
Updated: A later scan finds it again, perhaps in new places or with changed properties. Where it is deployed, and when it was last seen, stay current.
-
Resolved: The scans that cover it no longer find it, because it was removed, replaced or remediated. It leaves the active inventory but keeps its history.
Reactivated: A resolved item that turns up again is brought back, and its history continues.
You can open any item's history from its detail view and see exactly what changed between versions. Time-series widgets use the same history to chart risk and policy compliance over weeks or months, and to answer what the estate looked like on a given date. Discovery History shows what each scan delivered, and notification cases follow a finding until it is resolved. Every user action is recorded in the Audit Trail.
Focusing the Analysis with Tag Scopes
Most dashboard widgets can be narrowed to part of the estate with
a Tag Scope. That part might be a region, a
business unit, an environment, a data classification, or an
owner — whatever your organisation tags by. A scope is a named
expression over your tags, such as
"EMEA" $and "Production". It is defined once and
chosen in any widget's settings.
A scoped widget shows the scope's name beside its title. Its drill-downs and timelines stay within the scope, so a dashboard can put several slices of the estate side by side. See Focusing a Widget with a Tag Scope and Tag Scope.
Getting Started
Sign in, and take the guided tour offered on your first visit.
Add the machines to scan on Host, or connect a cloud account on Cloud Servers.
Build a sensor Template. The Sensors Reference explains what each sensor finds and needs.
Create and run a Task, then check what it delivered in Discovery History.
Explore the results on the Dashboard, the Reports and the Crypto Inventory pages.
Choose the policies to measure against, and set up Notifications for what matters.
Using This Help
The menu on the left is in two parts. The upper part follows the application's own left menu, so the help for a screen is filed where that screen lives in the product. The part below the line holds the guides that are not tied to one screen.
| Section | Covers |
|---|---|
| Using the application | |
| Dashboard | The home dashboard, widgets, templates and layouts. |
| Discovery | Hosts, templates, tasks, discovery history, tags, tag scopes, integrations, cloud servers, CycloneDX export, and the sensors. |
| Reports | The Summary and PQC reports. |
| Insights | The CBOM AI Query assistant and the Source Code Visualizer. |
| Crypto Inventory | The Key, Certificate, CipherSuites and Analysis pages. |
| Governance | User policies and standard policies. |
| Notifications | Cases, criteria, notification formats, rules, connections and engine health. |
| Administration | User management, roles and permissions, the audit trail and system logs. |
| Top Bar | Dashboard submenus, the notifications bell, help, the user menu, and System Configuration. |
| Guides and reference | |
| Login and Authentication | Signing in, realms and sessions. |
| CBOM Guide | Architecture, installation, system administration, access control, sensors and connectors, and integrations. |
| Administrative Guide | The administrative guide's cover page and copyright. |
| Reference | Glossary, configuration keys, data model, API, CycloneDX mapping, scoring, standards, the widget catalogue and AI data handling. |
Every page lists its own sections under On this Page, and Previous and Next at the bottom walk through the help in menu order. In the application, the ? in the top bar opens the help page for the screen you are on.