"Harvest now, decrypt later" is already a budget line. Adversaries record encrypted traffic today to break it once quantum hardware arrives, and standards bodies have set post-quantum migration deadlines. You cannot migrate what you cannot see — vulnetix cbom turns "where is our quantum-vulnerable crypto?" into a single command.
Four detection passes
Source code
Per-language crypto API usage, normalized to one canonical SPDX name.
Config & protocols
TLS suites and versions, SSH ciphers, JWT alg, OpenSSL and IPsec settings.
Certificates & keys
X.509 signature algorithm, key type and size, validity — metadata only, never key bytes.
Dependencies
Declared crypto libraries — OpenSSL, Bouncy Castle, libsodium, liboqs, Tink and more.
Post-quantum posture
The builtin catalog (version 2026.06.1) classifies 41 algorithms and 12 crypto libraries. Every algorithm is tagged quantum-safe, quantum-vulnerable, deprecated or hybrid with a NIST quantum-security level — covering the NIST PQC standards (ML-KEM, ML-DSA, SLH-DSA), additional PQC (Falcon, HQC, FrodoKEM, Classic McEliece, LMS/HSS, XMSS), the Korean KpqC selections, hybrid groups, and the deprecated classical set (RSA, ECDSA, DES, 3DES, MD5, RC4, SHA-1).
Nine compliance lenses
Post-quantum guidance is not universal — RSA is transitional for BSI, disallowed for CNSA 2.0 and deprecated by NIST. The compliance lens re-scores the whole inventory against any of nine national and agency bodies: NIST, CNSA 2.0, BSI, NCSC, AIVD, ACSC, CCCS, NÚKIB and KpqC. One snapshot answers "are we compliant?" and "what do we migrate first?" at once.
No new workflow
CBOM runs inside vulnetix scan (disable with --no-cbom), gates CI with --fail-on quantum-vulnerable, and uploads to the Crypto Inventory console at /vdb-crypto-inventory. The CycloneDX output sits alongside the SBOM, VEX and SARIF the same scan already produces.