What’s New in CBOM Secure V1.1: Enterprise PQC Guidance

Key Takeaways

• CBOM Secure V1.1 adds AWS cloud discovery alongside existing Azure, GCP, HashiCorp Vault, HSM, and on-premises support.
• A new CrowdStrike Falcon integration imports host inventory automatically, with deduplication and RTR-based scanning.
• An interactive Source Code Visualizer maps cryptographic API usage and library dependencies across application code.
• Cryptographic Material can now be custom-tagged and queried through dedicated Tag APIs for filtering and grouping.
• A new PQC multi-chart shows how quantum-relevant algorithms are distributed across discovered assets, filterable by algorithm family and risk category.
• An AI Service module brings Retrieval Augmented Generation to the platform for natural-language queries against NIST, FIPS, PCI, and RFC sources, including a fully offline mode for air-gapped networks.
• Model Context Protocol (MCP) integration turns the CBOM into structured context an AI model can reason over.
• All CBOM services are now containerized for Docker Compose deployment with Nginx as a reverse proxy.

Published: June 2026. Updated: August 2026. Reviewed by Encryption Consulting’s product engineering team.

What Is CBOM Secure?

A Cryptography Bill of Materials, or CBOM, is a structured inventory of every cryptographic asset in an environment: keys, certificates, algorithms, and the libraries that implement them, along with how those assets relate to one another. CBOM Secure is Encryption Consulting’s platform for building and maintaining that inventory. It discovers, inventories, and continuously monitors cryptography across application source code, cloud, and on-premises infrastructure from a single deployment, then scores each asset for compliance risk and quantum exposure.

What makes the inventory trustworthy is how the platform models what it finds. Rather than treating each key or certificate as an isolated list entry, CBOM Secure builds a relationship graph that links certificates to their private keys and traces how secrets are consumed across services. Most enterprises have no clear inventory of their cryptography at all, and every inventory is only as good as the places it can reach. A platform that sees your cloud KMS but not your source code, or your certificates but not the hosts they live on, leaves exactly the gaps that audits and quantum migrations expose. That completeness is the idea CBOM Secure is built on, and it is what V1.1 is built to extend.

“Most cryptographic inventories stop at certificates and network endpoints. The risk that matters often lives deeper: in source code, and in the relationships between keys, certificates, and the services that consume them.“
–Puneet Singh, Principal, Encryption Consulting LLC

What’s New in CBOM Secure V1.1?

V1.1 is a release about extending reach. It widens where the platform can discover cryptography, sharpens how teams explore and organize what it finds, and hardens the platform underneath so it deploys cleanly into production. Here is everything that changed.

Reaching More of Your Estate: New Discovery Sources

The headline of this release is reach. Two new discovery paths bring large parts of the enterprise into the CBOM that were previously hard to inventory.

CrowdStrike Falcon integration

CBOM Secure now connects directly to CrowdStrike Falcon to import host inventory. Hosts found through Falcon are synchronized automatically into the CBOM host registry and deduplicated, so teams already running CrowdStrike gain visibility into the cryptographic assets on those hosts without standing up a separate discovery deployment. The integration ships with a deduplication review panel to merge or separate duplicate host entries, filtering by source so hosts brought in through CrowdStrike are easy to distinguish, and bulk host selection with pagination for large sync operations. Scans can be deployed to a client’s target host using CrowdStrike’s RTR protocol, which means discovery can run through the tooling already deployed.

AWS cloud discovery

The CBOM Discovery Manager now scans AWS cloud environments, depositing results straight into the asset inventory alongside existing support for Azure, GCP, HashiCorp Vault, HSMs, and on-premises infrastructure. New JWT token logic secures collector-to-cloud communication, and AWS results are validated into the platform’s CMDocs and CMDeposit collections. The cloud scan logic has been hardened to handle edge cases and empty result sets cleanly, so a quiet account does not produce a noisy result.

Discovery sensor documentation and setup scripts

To make all of that deployable, V1.1 adds detailed documentation for Discovery Manager and sensor deployment, plus automated setup scripts for provisioning discovery and build servers. The material covers remote sensor deployment, builds across platforms, and sensor configuration on GCP, Azure, and AWS.

Exploring and Organizing What You Find

Discovering cryptography is the first step. V1.1 also makes the inventory easier to navigate and to slice.

Source Code Visualizer

A new interactive Source Code Visualizer gives teams a graphical map of cryptographic API usage and library dependencies across application code. It surfaces deprecated algorithms, hardcoded secrets, and embedded credentials before code ships, and catching those issues that early makes remediation roughly 100 times cheaper than fixing them after an incident. Instead of reading findings as a flat list, teams can see how the pieces of an application relate. The component shipped with security hardening and a set of usability improvements aimed at readability and navigation.

Cryptographic Material tagging

Cryptographic Material (CM) documents and deposits now support custom tags. Tags can be applied, updated, and queried through dedicated Tag APIs, with validation enforced on the MongoDB side for both CMDeposit and CMDocs records. The practical payoff is filtering and grouping: assets can be organized by whatever scheme fits how a team works, then sliced by tag.

Post-quantum cryptography multi-chart

The dashboard gains a new PQC chart that visualizes how quantum-relevant algorithms are distributed across discovered assets. It supports filtering by algorithm family and by risk category, giving migration planners a clearer read on where vulnerable cryptography is concentrated and how a transition is progressing.

New on the Platform

Three additions round out the release across assistance, documentation, and deployment.

AI Service module

V1.1 introduces a new AI Service module that brings Retrieval Augmented Generation (RAG) to the platform, letting teams query CBOM documentation and major compliance sources, including NIST, FIPS, PCI, and RFC standards, in natural language. It includes a document ingestion pipeline, an LLM query interface, and a chat UI. Importantly for security-conscious environments, it can download and index documentation for fully offline assistance, so the model works inside air-gapped and restricted networks without reaching outside the perimeter. Where the environment allows it, the module can optionally be configured to pull additional information from the internet. The result is a way to interrogate dense compliance material and cryptographic posture without leaving the platform.

MCP-powered AI capabilities

The AI Service module is the first step in a larger direction. By embedding the Model Context Protocol (MCP) into CBOM Secure, the platform converts its cryptographic inventory, including discovered crypto materials, policy configurations, sensor data, and analytic rules, into structured context that AI models can reason over in real time. That foundation lays the groundwork for capabilities such as natural-language querying of the CBOM, AI-assisted remediation recommendations, and automated anomaly detection across clouds and on-premises sensors. MCP also surfaces these discovery insights in the React dashboard, which serves both security engineers and auditors, moving the platform from passive inventory toward active cryptographic risk management.

Comprehensive in-app documentation

Full documentation is now built into the CBOM web interface, covering the Dashboard, Keys, Certificates, Cipher Suites, Analysis, Reports, AI Services, User Management, Policy Management, and System Configuration. Internal linking and routing were fixed so navigation between sections is seamless, which means answers live next to the screens they describe.

Docker production deployment with Nginx

All CBOM services are now containerized and deployable via Docker Compose, with Nginx acting as a reverse proxy in front of the microservices, and the result runs equally well in cloud, on-premises, and air-gapped environments. A seed data image populates MongoDB indexes and initial configuration on first boot, dedicated Docker entry points streamline container startup for each service, and the frontend Vite build is folded into the Docker pipeline. The path from zero to a running production deployment is far more repeatable.

How Does CBOM Secure Support PQC-Readiness and Cryptographic-Inventory Prerequisites?

A cryptographic inventory is the prerequisite every PQC migration plan depends on: an organization cannot replace vulnerable algorithms it has not found. The stakes of skipping that step are concrete. A single expired certificate can take a service down at a cost north of $300,000 an hour, and the manual audits teams still rely on can swallow four to eight weeks every cycle. The quantum clock is tightening too: a recent federal executive order pulled the civilian agency migration deadline forward from 2035 to as early as 2030 for key establishment and 2031 for digital signatures. Most tooling on the market still looks at certificates or network services in isolation, which leaves teams stitching together three or more products to see one estate. CBOM Secure is designed to replace that patchwork with a single inventory, and V1.1’s AWS and CrowdStrike discovery sources close two of the most common gaps in that estate view.

Risk scoring from 0 to 100 flags weak algorithms, expiring certificates, short validity windows, self-signed certificates, key reuse, and insecure cipher configurations, so analysts know what to fix without sorting through everything by hand. That scoring, combined with the new PQC multi-chart, is what turns a raw inventory into a prioritized migration backlog.

What Algorithm and Interoperability Considerations Does CBOM Secure Surface?

CBOM Secure exports findings in the open CycloneDX format, so a CBOM interoperates with SBOM, GRC, and supply chain tooling instead of locking an organization into a single vendor’s data model. That matters for interoperability because most enterprises already run separate SBOM and vulnerability-management pipelines, and a CBOM that cannot hand off data to them recreates the same silos it is meant to remove.

Two caveats are worth stating plainly. First, algorithm and library coverage is bounded by what discovery sources are connected: cryptography inside an environment that has not been onboarded to a sensor, CrowdStrike sync, or a supported cloud discovery path will not appear in the inventory, which is exactly why expanding discovery reach is the headline of this release. Second, custom or proprietary cryptographic implementations that do not match known library signatures may need the Source Code Visualizer’s manual review and the new tagging system to be classified correctly rather than being caught automatically on first scan.

What Phased Migration Steps Does CBOM Secure Support?

1. Deploy discovery sensors and connect the CrowdStrike Falcon integration to bring hosts, endpoints, and existing EDR-managed assets into the CBOM host registry.
2. Onboard cloud environments, including the new AWS discovery path alongside Azure, GCP, HashiCorp Vault, and on-premises HSMs, so no major infrastructure surface is left unscanned.
3. Run the Source Code Visualizer across application repositories to catch deprecated algorithms, hardcoded secrets, and embedded credentials before code reaches production.
4. Tag and organize discovered cryptographic material by business unit, environment, or compliance scope using the Tag APIs, so the inventory can be sliced the way the organization actually works.
5. Review the PQC multi-chart to prioritize remediation by algorithm family and risk category, focusing first on the highest-risk, highest-exposure assets.
6. Query the AI Service module against NIST, FIPS, PCI, and RFC sources to validate remediation choices against current standards before implementing changes.
7. Track remediation progress against the 0 to 100 risk score and export CycloneDX-format CBOM reports as audit evidence for regulators and internal governance.

What Testing and Validation Evidence Backs V1.1?

V1.1’s platform-level additions were built and hardened for production use rather than shipped as early betas. The AWS cloud scan logic was specifically hardened to handle edge cases and empty result sets cleanly, and collector-to-cloud communication is secured with new JWT token logic rather than static credentials. The CrowdStrike integration ships with a deduplication review panel so sync results can be checked and corrected rather than trusted blindly, and the Source Code Visualizer shipped with a dedicated security hardening pass alongside its usability improvements.

The operational payoff of that hardening shows up in measured outcomes from CBOM Secure deployments: compliance audits that once meant manual reconstruction take 70 to 80 percent less time, with every change captured in a tamper-evident trail that produces defensible evidence for regulators on demand. When a certificate authority is compromised or an algorithm is publicly broken, identifying the blast radius drops from days or weeks to minutes, which is how organizations typically cut certificate-related incidents by more than 90 percent in their first 90 days.

How Does V1.1 Compare to V1.0?

Capability	V1.0	V1.1
Cloud discovery	Azure, GCP, HashiCorp Vault, HSMs, on-premises	Adds AWS, with hardened edge-case and empty-result handling
Endpoint discovery	Sensor-based host discovery	Adds CrowdStrike Falcon sync with dedup review and RTR-based scanning
Source code analysis	Source Code Sensor findings as a flat list	Adds interactive Source Code Visualizer graph view
Asset organization	Fixed inventory fields	Adds custom Cryptographic Material tagging via Tag APIs
PQC migration insight	Asset-level PQC risk scoring	Adds a PQC multi-chart by algorithm family and risk category
Compliance research	Manual reference lookup	Adds an AI Service module (RAG) for NIST, FIPS, PCI, and RFC queries, offline-capable
AI integration	None	Adds MCP-powered structured context for AI reasoning
Deployment	Manual or scripted setup	Adds Docker Compose plus Nginx containerized production deployment
Documentation	External only	Adds full in-app documentation across every module

Implementation Checklist for Adopting V1.1

• Confirm the current CBOM Secure version and back up existing tag and policy configuration before upgrading.
• Provision AWS discovery credentials and validate the new collector-to-cloud JWT authentication in a non-production account first.
• Connect the CrowdStrike Falcon API and run an initial host sync, then work through the deduplication review panel before trusting the merged registry.
• Retag existing cryptographic material against the taxonomy the team plans to use going forward, rather than tagging ad hoc.
• Validate the Docker Compose and Nginx production deployment path in staging before cutting over a live environment.
• If operating air-gapped, confirm the AI Service module’s offline documentation index covers the compliance sources the team actually needs.
• Review the new in-app documentation for each module before rolling access out to auditors and security engineers.
• Re-run the PQC multi-chart after upgrade to set a fresh migration-priority baseline.

What Are the Limitations of CBOM Secure V1.1?

V1.1 is a significant reach and usability release, but it has real boundaries worth stating. Coverage is only as good as what is connected: cryptography in an environment that has not been onboarded through a sensor, the CrowdStrike sync, or a supported cloud discovery path will not appear in the inventory. The AI Service module’s offline mode is limited to the compliance documents it has ingested and indexed; its optional internet-connected mode depends on organizational policy and network access. The MCP integration is described as a foundation: natural-language querying of the CBOM, AI-assisted remediation recommendations, and automated anomaly detection are named as capabilities the integration lays the groundwork for, not features that all ship complete in this release. Custom or proprietary cryptographic implementations may still need manual review through the Source Code Visualizer and tagging system rather than being classified automatically on first scan.

What Would Encryption Consulting Recommend?

If an organization is already running CBOM Secure, upgrade to V1.1 and prioritize connecting AWS and CrowdStrike Falcon first. Those two sources typically close the largest visibility gaps because they cover an entire cloud account and an entire EDR-managed fleet in one sync, rather than requiring asset-by-asset onboarding. From there, run the Source Code Visualizer against the highest-risk application repositories and let the PQC multi-chart set remediation priority instead of working through the inventory alphabetically.

If an organization does not yet have a cryptographic inventory, this release is a reasonable point to start. A patchwork of certificate scanners and network tools will keep missing the source code, host, and cloud gaps that V1.1 was built to close, and the quantum migration deadlines now in place do not leave room for a multi-year inventory project before remediation can begin. Encryption Consulting is ISO/IEC 27001:2022 and SOC 2 certified, and CBOM Secure pairs directly with our PQC Advisory nine-phase roadmap, CertSecure Manager for certificate lifecycle remediation, and HSM-as-a-Service for key custody once weak keys are identified. To see V1.1 in your environment, request a demo or reach out to [email protected].

Frequently Asked Questions

What is CBOM Secure? CBOM Secure is Encryption Consulting’s cryptographic discovery and inventory platform. It discovers, inventories, and continuously monitors keys, certificates, algorithms, and cryptographic libraries across application source code, cloud, and on-premises infrastructure, then scores each asset for compliance risk and quantum exposure from a single deployment.

What is new in CBOM Secure V1.1? V1.1 adds AWS cloud discovery, a CrowdStrike Falcon integration for host inventory, an interactive Source Code Visualizer, custom Cryptographic Material tagging, a PQC multi-chart, an AI Service module for natural-language compliance queries, Model Context Protocol integration, full in-app documentation, and a Docker Compose production deployment path with Nginx.

Does CBOM Secure support AWS discovery now? Yes. As of V1.1, the CBOM Discovery Manager scans AWS cloud environments directly, alongside its existing support for Azure, GCP, HashiCorp Vault, HSMs, and on-premises infrastructure, with results validated into the platform’s asset inventory.

Can CBOM Secure run in an air-gapped environment? Yes. The AI Service module can download and index documentation for fully offline assistance, so it works inside air-gapped and restricted networks without reaching outside the perimeter, and the entire platform is deployable via Docker Compose in cloud, on-premises, or air-gapped environments.

How is CBOM Secure different from a manual spreadsheet-based crypto inventory? A manual inventory is a point-in-time snapshot that goes stale as certificates rotate and code changes. CBOM Secure continuously discovers and monitors cryptographic assets, models the relationships between keys, certificates, and the services that consume them, and scores risk automatically, which is why compliance audits built on it take 70 to 80 percent less time than manual reconstruction.

Conclusion

The throughline of V1.1 is coverage an organization can act on. CrowdStrike and AWS discovery pull more of the real environment into the CBOM; tagging and the Source Code Visualizer make a larger inventory navigable; the PQC chart turns discovery into migration insight; and the Docker, documentation, and AI additions make the platform easier to stand up and operate. CBOM Secure is built for the quantum transition, tracking exposure to vulnerable algorithms and the adoption of quantum-safe alternatives across the full environment. Findings export in the open CycloneDX format, and one deployment can serve multiple business units across a large enterprise.

For the broader case on why cryptographic inventories fail when they rely on network scanning alone, see The Cryptographic Blind Spot Hiding in Your Own Infrastructure. For a canonical field-level data model to structure inventory findings, see Cryptographic Inventory Data Model for PQC Migration. For how a CBOM and an SBOM work together, see CBOM vs SBOM: Why PQC Migration Needs Both.

References

• NIST, Post-Quantum Cryptography Standardization: FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), FIPS 205 (SLH-DSA), csrc.nist.gov
• OWASP CycloneDX, Cryptography Bill of Materials (CBOM) specification, cyclonedx.org
• Encryption Consulting, CBOM Secure product page, encryptionconsulting.com/cryptographic-discovery-inventory/