No inventory
Most teams cannot list every place they encrypt, sign or hash data, so they cannot say what a change in the rules means for them.
Cryptography, mapped
Know every key, certificate and cipher your software trusts.
CipherMap is an AI agent that finds all the cryptography in your systems, ranks what is at risk, fixes it with pull requests you review, and proves your progress, starting with the move to quantum-safe cryptography.
At risk todayQuantum-safe
Aug 2024NIST publishes the first quantum-safe standards
47 daysLongest a public TLS certificate may last from 2029
2030NIST plans to deprecate RSA and elliptic-curve keys
2035Today’s public-key algorithms disallowed
The problem
Cryptography is everywhere. Nobody holds the full list.
Ask most companies “where do we use cryptography, and is it still strong?” and nobody can answer in full. It is spread across code, cloud settings, certificates, vaults and the libraries buried in your dependencies, owned by different teams, and it changes every day.
Certificates expire
An expired certificate can take a whole service offline. Certificate lifetimes are shrinking every year, so renewals will soon be constant.
Weak algorithms linger
MD5, SHA-1, short RSA keys and old TLS settings live on in legacy code and third-party libraries long after they stop being safe.
Keys leak
Keys and secrets end up in repositories, logs, tickets and, more and more, in AI prompts and agent tools, often with nobody rotating them.
Harvest now, decrypt later
Attackers can copy encrypted data today and keep it until a large quantum computer can break it. Data that must stay secret for years is already exposed.
How it works
Map. Rank. Fix. Prove.
CipherMap works like a careful engineer who never gets tired: it reads everything, writes down what it finds, explains why it matters and proposes the fix.
Map
Scans code, configuration, certificates, cloud settings and dependencies, and builds a cryptographic bill of materials (CBOM): every algorithm, key and certificate, and where it lives.
payments-api → TLS 1.2, ECDHE P-256, cert expires in 19 days
Rank
Sorts what it finds by real risk: how weak the algorithm is, how sensitive the data is, how long it must stay secret and how exposed the system is.
High: customer records under RSA-2048, must stay secret 10+ years
Fix
Opens pull requests that swap weak or outdated cryptography for strong, quantum-safe options, with tests and a plain explanation. Nothing merges without your review.
PR #142: hybrid X25519 + ML-KEM-768 for service-to-service TLS
Prove
Keeps a live record of what changed, when and why, ready for auditors, customers and regulators who ask how far your migration has come.
Quantum-safe coverage: 64% → 91% this quarter
What it covers
The trust layer of your software
CipherMap covers everything that proves who someone is or keeps data secret. That is wider than encryption alone, and deliberately narrower than “security”.
Encryption
Data at rest and in transit: databases, backups, storage buckets, queues and the settings that protect them.
Keys and secrets
Where keys live, who can use them, how old they are and whether they are ever rotated, across vaults, KMS and code.
Certificates and TLS
Every certificate, its issuer, expiry and key, plus weak protocol versions and cipher suites on every endpoint.
Signatures and tokens
Logins, single sign-on, API tokens and JWTs, code signing and software supply-chain signatures.
Hashing and passwords
Password storage, integrity checks and the hash functions behind them, flagging anything that is no longer safe.
Libraries and dependencies
The cryptography your open-source and vendor libraries bring with them, which rarely shows up in anyone’s list.
Quantum-safe migration
A plan and the pull requests to move from RSA and elliptic-curve cryptography to ML-KEM, ML-DSA and SLH-DSA, including hybrid modes.
New risks from AI
Keys and tokens handed to AI agents, secrets pasted into prompts, and AI-written code that brings weak cryptography with it.
Out of scope by design: firewalls, malware, phishing and general vulnerability scanning. Plenty of good tools already do those well. CipherMap does one job: the cryptography your software relies on.
Why now
The deadlines are already set
A large enough quantum computer will break the public-key cryptography most of the internet uses today. Nobody knows exactly when, but governments are not waiting: the standards are published and the timelines are on paper.
Moving a whole company’s cryptography takes years. The teams that start with a full map will finish on time; the rest will be guessing.
- AUGUST 2024
NIST publishes the first quantum-safe standards: ML-KEM (FIPS 203), ML-DSA (FIPS 204) and SLH-DSA (FIPS 205).
- 2025
The EU sets a coordinated roadmap for its member states to move to post-quantum cryptography.
- 2026 · NOW
Organisations are expected to start: inventory their cryptography and plan the migration. Public TLS certificates drop to a 200-day maximum.
- 2029
Public TLS certificates max out at 47 days, so renewal has to be fully automated.
- 2030
High-risk systems should be migrated under the EU roadmap, and NIST plans to deprecate today’s RSA and elliptic-curve keys.
- 2035
Today’s public-key algorithms are disallowed under NIST’s transition plan.
Who it is for
Built for the people who get asked “are we ready?”
Security and platform teams
One accurate picture of every key, certificate and algorithm, kept up to date, and fixes that arrive as pull requests instead of tickets.
Compliance and risk
Evidence for auditors and customer questionnaires: what you use, what you changed and how far the migration has come.
Engineering leaders
A ranked plan with effort attached, so quantum readiness becomes a project you can schedule, not a worry you carry.
Regulated industries
Finance, health, government suppliers and the SaaS companies that sell to them, where data must stay secret for years.
Principles
How CipherMap is built
Read-only by default
CipherMap looks before it touches. Mapping needs read access only; anything more is your choice.
Every change is reviewed
Fixes arrive as normal pull requests with tests and reasons. Your engineers stay in charge of what merges.
Evidence, not opinions
Every finding points to the exact file, setting or certificate, and to the standard that says why it matters.
Standards first
Recommendations follow NIST, IETF and national guidance, not vendor fashion, and say so when a standard is still a draft.
What is a cryptographic bill of materials (CBOM)?
A full list of the cryptography a system uses: each algorithm, key, certificate and library, where it lives and what it protects. It is to cryptography what a software bill of materials is to dependencies, and it is the first thing any quantum-safe plan needs.
If quantum computers cannot break encryption yet, why act now?
Because data stolen today can be decrypted later, and because moving a whole company’s cryptography takes years. Regulators have already set dates in the early 2030s, and certificate lifetimes are shrinking now.
Is CipherMap a vulnerability scanner?
No. It focuses only on cryptography: what you use, how strong it is and how to move to something stronger. It works alongside the security tools you already have.
Will it change my code on its own?
No. CipherMap proposes changes as pull requests. Nothing merges unless someone on your team reviews and approves it.
How do I get access?
CipherMap is in development, and early-access teams help shape what it does first. Tell us about your stack and what you need to prove, and we will get in touch.
Early access
Start with a map.
Find out where your cryptography lives, what is at risk and what to fix first, before the deadlines arrive.