Every source of cryptographic evidence,
unified into one CBOM for each of your assets.
UCDI brings together what its own discovery finds with what your existing scanners, suppliers and system owners already know. Every finding is tied to the system it belongs to and judged by one knowledge base, so each asset has a complete, evidence-backed view of its cryptography and its quantum risk.
Delivered as SaaS, connected on-premises or fully air-gapped. Built to CERT-In's CBOM and QBOM guidelines. Exports CycloneDX 1.7.
Every quantum-safe timeline starts with the same step: know what you have.
India
CERT-In's Technical Guidelines v2.0 (July 2025) define what a CBOM and a QBOM must contain. The Reserve Bank constituted an expert committee on a quantum-secure financial ecosystem in May 2026.
United States
Federal agencies inventory their cryptographic systems every year under OMB M-23-02. NIST IR 8547 (draft) proposes deprecating quantum-vulnerable public-key algorithms after 2030 and disallowing them after 2035.
European Union
The coordinated roadmap (June 2025) calls for national strategies and cryptographic inventories by end-2026, and high-risk use cases transitioned by end-2030.
United Kingdom
NCSC timelines (March 2025): discovery and planning by 2028, high-priority migration by 2031, completion by 2035.
An inventory built one tool at a time leaves gaps between the tools. UCDI builds it as one.
Many sources. One view of each asset.
Cryptographic evidence is scattered. Some of it is on the wire, some in code and containers, some in the scanners you already run, some with your suppliers, and some only with the people who run each system. UCDI brings all of it into one model and ties every finding to the asset it belongs to.
Evidence from everywhere
Discovered by UCDI
Network traffic, active assessment, hosts and files, source code, container images, public intelligence.
From your ecosystem
Results from the scanners you already run, configuration exports, suppliers' CBOMs and SBOMs.
From your people
Structured questionnaires and evidence requests to system owners.
Unified by UCDI
One model
Every finding becomes a certificate, key, protocol, cipher suite or library record, whatever its source.
Linked to its asset
Matched by hostname, IP address or domain, and confirmed by an analyst where the match is not certain.
One verdict
Classified by a single knowledge base, whichever source found it.
Source kept
Each finding records where it came from and how far it can be trusted.
A cryptography view for every asset
An asset-level CBOM
In CycloneDX 1.7, for one asset, a group of assets or the whole estate.
Gaps on the asset
Including where what owners state differs from what is observed.
Readiness per asset
Weighed by criticality, data sensitivity and retention.
Ready to hand on
To CERT-In conformance reporting and to QRAM for prioritisation.
One asset. Every source. One verdict.
This is what a single system looks like once UCDI has brought its evidence together. Each finding keeps the source it came from, each carries a verdict from the same knowledge base, and where a system owner's statement differs from what is observed, the gap is raised on the asset itself.
Payments gateway, production
Business criticality very high. Restricted data, retained ten years.
Gap on this asset. The owner states TLS 1.3 only; TLS 1.2 is still observed.
Six sources, one asset. Each finding keeps its source, and the whole view exports as a CycloneDX 1.7 CBOM for this asset.
Why a unified view changes the answer.
The asset is the unit, not the scan
Findings attach to the assets they belong to, with shared infrastructure linked to every asset that depends on it. You see an asset's cryptography whole, not scattered across reports.
Third-party evidence counts
Your existing scanners' results and your suppliers' CBOMs join the same register and are judged by the same rules, with any disagreement against your scanner's own verdict shown.
A claim never passes for a fact
Every finding is labelled observed, declared or supplier-provided, with a confidence level. When an owner's statement and the observed reality differ, the gap is raised on that asset.
One verdict, whichever source
One knowledge base judges everything, including each session by the key exchange it actually negotiated. When standards change, stored findings are re-classified without rescanning.
Enable business context beside the cryptography
Criticality, data sensitivity, retention and dependencies travel with each asset, so exposure is weighed by what the system does for your business.
Blind spots are named
Each source states what it cannot observe, and every Unknown carries a reason, so a report never turns a gap in coverage into a clean result.
One inventory, and every team that answers for it.
Board and executives
How exposed each critical system is
Exposure and readiness for every asset on one scale, ready for QRAM to turn into a risk-ranked plan.
CISOs and security leaders
Coverage you can stand behind
Every source in one register, with blind spots named before an audit finds them.
Compliance and audit
Evidence a regulator can check
Signed, versioned CBOMs per asset or estate, and conformance reports against guidelines like CERT-In and others.
PKI and key owners
Every certificate and key, wherever it lives
Expired certificates, short keys and quantum-vulnerable algorithms raised as gaps on the systems that use them.
Architects and developers
The exact code and libraries to change
Cryptographic calls, library versions and the post-quantum APIs already adopted, placed on the systems they run in.
Vendor and third-party risk
Suppliers' cryptography, in scope
Vendor CBOMs and SBOMs held to the same standard as your own findings, on the assets that depend on them.
Multi-modal discovery, built to grow.
UCDI gathers evidence through complementary modes. Start with those that need nothing installed, add depth where it matters, and every mode, including the ones still to come, feeds the same unified view.
Public intelligence
Certificates, DNS records and identity keys already visible from the internet. Nothing installed.
Configuration and exports
The files your teams already export from servers, network devices, hypervisors and cloud key services. Nothing installed.
Network observation
The cryptography actually negotiated on the wire. Traffic is never decrypted.
Active assessment
What each service offers when asked, including post-quantum key exchange.
Hosts and files
Certificates, keys and libraries on servers and endpoints.
Code and containers
Cryptographic use in source code, dependencies and container images.
Your existing scanners
Results you already hold, re-judged by UCDI. Nothing installed.
Suppliers and people
Vendor CBOMs and SBOMs, and structured questions for the owners of each system. Nothing installed.
Ready for CERT-In's guidelines, without assembling the evidence by hand.
CERT-In's Technical Guidelines on SBOM, QBOM and CBOM v2.0 set out what a cryptographic bill of materials, and a bill of materials for quantum devices, must contain. UCDI was engineered against Chapter 8, clause by clause, so the product produces the evidence and your team reviews it.
Every Table 9 element, on every export
Algorithms, related crypto material, protocols and certificates mapped to CycloneDX 1.7 and checked each time, for one asset, a group or the whole estate.
A conformance report you can file
Generated from your own inventory as PDF or JSON, element by element, stating what is missing and why.
Proof that still holds later
Bills of materials signed and versioned with lineage, so any past submission can be verified and compared.
CERT-In does not operate a certification scheme for bills of materials. UCDI gives you the evidence to demonstrate conformance, and a clause-by-clause statement of how the product addresses Chapter 8 is available on request. The same conformance engine takes other regulators' profiles as data, so the evidence travels with you across jurisdictions.
Deployed the way your regulator requires.
The deployment model is agreed with you for each engagement, and different estates within one organisation can use different models.
SaaS
Managed by AvinyaSQ. Hosting topology and data residency are agreed with you, including in-country hosting where your regulator requires it.
Connected on-premises
On your own servers or in your own cloud tenancy. Internet access, where you allow it, adds public sources; the platform never depends on it to run.
Fully air-gapped
No external dependency at runtime, with licences activated offline. Internet-only sources are unavailable; vulnerability data loads from a mirrored feed.
See one of your systems through UCDI.
Bring a domain name, a few configuration exports and a recent scanner report. We will show your team the cryptography view UCDI builds for your assets before anything is installed, then take it into QRAM to decide what to migrate first.
Structured walkthrough on your own assets. Nothing installed. No implementation commitment required.