1. Observe deterministically
Supported scanners use bounded protocol negotiation, certificate parsing, dependency analysis, configuration parsing or static rules. AI is not the source of an authoritative cryptographic asset.
2. Preserve evidence
Each finding keeps its source, location, timestamp, detection method, confidence reason and relevant public metadata.
3. Normalize assets
Source-specific observations map to one cryptographic asset model. Identical certificates are reconciled by fingerprint while separate endpoint observations remain visible.
4. Assess with versioned rules
Migration relevance uses reviewed standards data and rule versions. Results explain what was found, why it matters and the next action without an unexplained readiness score.
5. Report coverage honestly
Reports distinguish scanned, discovered, inferred, unknown and not-scanned scope. Public exposure is never represented as a complete organizational inventory.