Discover, inventory, and govern every cryptographic asset.
CAMP continuously maps the cryptography running across your enterprise — certificates, keys, protocols, libraries and their FIPS posture — builds the network topology, and guides post-quantum migration of your most vulnerable assets. It runs entirely on-prem.
An ongoing crypto-asset management platform
Discovery finds it, the inventory governs it, compliance scores it, and alerts keep you ahead — a living picture of your cryptographic posture, not a one-off scan.
Boundary-scoped network discovery
Scan your network — never past the org gateway — to find hosts, services, and their TLS posture, then enrich with credentialed connectors (SSH, SNMP, Prometheus).
Canonical crypto-asset inventory
Every asset, certificate, key, protocol, cipher, algorithm and library in one encrypted, RBAC'd store — with owner assignment and a credential sign-off workflow.
Probes at every site
Enrol a probe at each site to scan networks the central server cannot reach, and add a passive sensor that records the cryptography actually in use in traffic, beside what each service offers.
Inferred link-level topology
Build the enterprise network graph from SNMP LLDP/CDP + ARP. Interactive diagram or list, with unmanaged peers surfaced as external nodes.
Color-coded cryptographic posture
Flag weak algorithms, deprecated TLS, non-FIPS and end-of-life crypto libraries, and risky open-port exposure — scored red-to-green by severity.
Evidence-based PQC migration
Compare what vendors claim — including the CBOMs they publish — against what each endpoint actually negotiates, separate a configuration change from a replacement, and track drift as the estate moves.
A CycloneDX CBOM of your network
Export the inventory as a CycloneDX 1.6 cryptographic bill of materials, with a PDF report: what is running and negotiated on your network, in the form OMB M-26-15 asks agencies to keep.
Email alerts for what changes
Weak cryptography, certificates nearing expiry, drift in what an endpoint negotiates, licence and scan events — each emailed to the recipients you choose.
Node-locked on-prem install
Docker Compose or Kubernetes, bundling its own Keycloak and PostgreSQL. Node-locked licensing; nothing leaves your environment.
Scan → inventory → sign-off → enrich → govern
A boundary-safe scan finds hosts and their TLS posture. Assets that need deeper inspection are flagged; the owner provides credentials in their own portal (encrypted, never shared). CAMP then enriches with hardware, applications, crypto libraries and FIPS status — and scores compliance red-to-green.
Discover
Boundary-scoped network scan finds hosts, services and TLS posture — never past the org gateway.
Own & sign off
Flagged assets get an owner; the owner provides credentials in their own login, sealed at rest.
Enrich
SSH / SNMP / Prometheus connectors add make/model, apps, crypto libraries and FIPS status.
Govern
Color-coded compliance, link-level topology, and email alerts for expiry and weak crypto.
Self-host on your own infrastructure
CAMP runs entirely on your infrastructure. Request access and we email you a read-only registry login, the install instructions and a node-locked licence — bring the stack up, then activate it in the portal.
The images are private, so the install begins with a registry sign-in. Your credentials and the commands arrive with your licence.
Minimum requirements (self-hosted, single VM)
| Minimum | Recommended | |
|---|---|---|
| vCPU | 4 | 8 |
| RAM | 8 GB | 16 GB |
| Disk | 40 GB SSD | 100 GB SSD |
| OS | Linux x86_64 with Docker Engine 24+ | — |
| Network | outbound 443 to our image registry (install and upgrade only) | — |
What you actually get
Screens from a running installation, scanning a three-site estate of 149 assets.
