Finding the Crypto: Lessons from Cryptographic Asset Discovery in Government

Migration to post-quantum cryptography starts with a simple question: where is cryptography actually being used? In practice, answering that question is really hard. Cryptographic assets are distributed across networks, applications, certificates, protocols, devices and suppliers, while existing discovery tools each reveal only part of the picture. This talk shares lessons learned from bringing Dutch government security professionals together to explore Cryptographic Asset Discovery and Inventory (CADI). We look at different approaches to network and cryptographic discovery, what tools can and cannot find, where automation helps and where human investigation remains essential. The talk focuses on the practical gaps and surprises encountered along the way and what these mean for organisations preparing for PQC migration. You will leave this talk with a better understanding of the current state of cryptographic discovery, practical approaches you can try yourself and a clearer picture of why “finding the crypto” is not simply a tooling problem.