How a National Building Materials Manufacturer Built a Complete Cryptographic Inventory
CipherScout-driven discovery and CBOM generation across enterprise systems, supplier integrations and certificate infrastructure, delivering full cryptographic visibility before any migration decision.
Cryptographic surfaces scanned across the enterprise
CycloneDX 1.7 CBOM delivered across all systems
Client data accessed or retained by ExeQuantum
The organisation
Supply chain complexity meets cryptographic sprawl
A national building materials manufacturer operating across multiple sites, with enterprise systems spanning ERP, supplier portals, logistics platforms and internal communications. Commercial contracts, supplier pricing, design specifications and customer data flow through systems that rely on classical cryptography at every layer.
Manufacturing supply chains carry data with multi-year confidentiality requirements. Supplier contracts, pricing agreements and proprietary product specifications cannot afford to be exposed, whether the threat is today's adversaries or tomorrow's quantum computers. The Harvest Now, Decrypt Later risk applies directly: commercial data transmitted today over classically encrypted connections will be readable the moment a cryptographically relevant quantum computer arrives.
The challenge
Cryptography buried across the stack
No single view of where cryptography lived across the enterprise. Certificates were managed manually across sites. TLS configurations varied between production systems and supplier-facing portals. No cryptographic inventory existed, and no standard tool in the security stack inspected at the cryptographic layer.
Without an inventory, there was no way to assess quantum exposure, prioritise migration or satisfy the compliance requirements that regulators are beginning to mandate. The organisation needed to understand what they were running before they could plan what to replace.
The challenge was compounded by the breadth of the attack surface. Manufacturing enterprises do not operate a single application stack. They run ERP systems, supplier integration layers, warehouse management platforms, logistics APIs, email infrastructure and certificate hierarchies, each with its own cryptographic dependencies, many inherited from vendors rather than configured in-house.
The approach
A full CBOM before any migration decision
CipherScout was deployed across the enterprise to scan all 10 cryptographic surfaces: TLS, SSH, APIs, certificates, identity (JWT/JWKS/OAuth), KMS, email (DKIM/SPF/DMARC), databases, source code and IoT/OT devices.
The output was a full Cryptographic Bill of Materials in CycloneDX 1.7 format. Every cryptographic asset catalogued by algorithm family, key length, protocol version and certificate lifecycle. Risk scoring applied by quantum vulnerability severity, giving the organisation a prioritised view of what needed to change and in what order.
The discovery process surfaced operational security issues alongside quantum exposure: expired certificates, deprecated TLS 1.0/1.1 connections and weak key configurations that had gone undetected through conventional security assessments. These findings delivered immediate operational value, independent of the quantum readiness objective.
Engagement structure
Discover, then decide
Phase 1
Cryptographic Discovery
CipherScout deployment across all enterprise systems. Full CBOM generation in CycloneDX 1.7 format. Every cryptographic asset inventoried, scored and mapped to compliance frameworks.
CompletePhase 2
Risk Assessment and Remediation Planning
Prioritised migration roadmap based on the CBOM. Algorithm transitions sequenced by risk severity, system criticality and operational constraints.
UnderwayWhy it matters
What manufacturers learn when they look
Discovery routinely surfaces issues beyond quantum vulnerability. Expired certificates, deprecated TLS configurations, weak key lengths and misconfigured protocols appear in every enterprise we scan. The CBOM becomes an operational security asset, not just a compliance artefact.
For manufacturers with distributed infrastructure, multi-vendor supply chains and legacy integrations, the cryptographic inventory reveals security gaps that no other tool in the stack is designed to find. Standard vulnerability scanners, SIEM platforms and GRC tools do not inspect at the cryptographic layer. CipherScout does.
The organisations that will be best positioned when PQC mandates take effect are the ones that started the discovery work early enough to execute methodically. A CBOM generated today gives the organisation a clear, prioritised migration path. A CBOM generated under deadline pressure in 2029 gives them a crisis.
Ready to discover your cryptographic exposure?
Start with a discovery scan. See what is in your estate before the mandate decides for you.
More case studies