Get Enumerated IFG, LLC

Vendor-neutral cryptographic asset discovery

An inventory should say what it could not reach.

IFG produces cryptographic inventories and the coverage declarations that go with them — what was examined, by what method, in what window, and what was left unreached. We never remediate, so nothing on the page is shaped by what we would sell you next.

Book a 30-minute call Read a sample declaration
Coverage declarationIllustrative
External TLS endpoints network observationObserved present
SSH host keys, retired subnet network observationObserved absent
Ephemeral workload certificates outside this windowNot sampleable
Vendor-managed HSM partitions outside access grantNot sampleable
Reported complete100%
Surfaces not sampleable2 of 4

Counted against what was found. The two unreached surfaces emit no row, so they never enter the denominator.

The same examination, with its limits on the page. The last two rows are the ones most inventories never print.

Fictional exampleFull sample
IFG, LLC · Austin, Texas No remediation product or revenue Four working papers on Zenodo

The failure

Discovery theater.

Most cryptographic inventories are authoritative in form and silent about their own coverage. The tool reports what it found. What it never reached emits no row — so it cannot be counted, and the completion figure is calculated against the found set. A branch that was never examined looks exactly like a branch that is clean.

A claim about the estate is not a claim about the examination. We keep the two apart, and we put the second one in writing.

Three states

Every surface ends in one of three states. Not two.

Observed Present

The method reached the surface and the asset was there. A finding.

Observed Absent

The method reached the surface and the asset was not there. Also a finding.

Not Sampleable

Not reachable by this method in this window. Not a finding — a declared limit, stated on the page rather than left to be discovered later.

The honest residual

What remains, named by kind.

  • Catalog

    What the method had no way to recognize, because nothing told it the thing existed.

  • Detection

    What the method was pointed at and could still miss.

  • Temporal

    What was not there while we looked — ephemeral assets that break the assumption of a census.

The engagement

The Read.

One fixed-scope examination of a defined part of your estate. Step Zero℠ — the inventory that has to exist before any migration plan can be trusted.

  • Inventory

    Cryptographic inventory

    A machine-readable CBOM in CycloneDX, ready for your tooling and your auditors.

  • Declaration

    Coverage declaration

    What was examined, by what method, in what window — and what was not reached. Signed.

  • Residual

    Residual register

    Catalog, detection and temporal residual, stated surface by surface. The residual is declared by the examiner and is not edited by the client.

  • Read-out

    Working session

    Your security and audit leads read the findings and the residual together with us.

Terms

Scope, examination window and fee are fixed and agreed in writing before examination begins.

Scope a Read

See the deliverable before you book.

A fictional coverage declaration and its companion CBOM, built to show the format.

View declaration Download CBOM (JSON)

Independence

We inspect. We never remediate.

A firm that sells the fix cannot fully publish the limits of its own discovery; doing so argues against its product. IFG holds no remediation product and takes no remediation revenue. That is a structural position, not a promise — and it is why the limits of our examination go on the page.

  • Regional banks
  • Healthcare systems
  • Critical infrastructure operators
  • Acquisition-heavy enterprises

Writing

Author-deposited working papers and a preprint by Simel E. Jenkins Bey, CC BY 4.0 on Zenodo. Not peer-reviewed.

Writing