Discover
Networks, Windows and Linux servers, AWS, Azure, Google Cloud, Kubernetes, GitHub, GitLab, HashiCorp Vault and HSMs. Public certificates for your domains from certificate transparency logs, with nothing to install.
Cryptographic inventory & post-quantum readiness
Find every certificate and key before it causes an outage
PKIMap builds one inventory of the certificates, keys, secrets and encryption across your networks, servers and clouds, tells you what to fix first, and produces the reports your auditors accept.
Free plan: see how much is found and how serious it is, with one sensor for 7 days. No card needed.
One map of everything cryptographic you run
Certificates expire, keys leak, and old algorithms linger long after anyone remembers where they are. PKIMap finds them, ranks them and shows the evidence.
Prioritise
Expired and expiring certificates, weak keys and algorithms, private keys anyone can read, secrets in plain text, risky Active Directory certificate templates, and what is not ready for post-quantum. Ordered by what to fix first.
Prove
Compliance reports for NIST CSF 2.0, PCI DSS, ISO/IEC 27001 and regional frameworks, each finding linked to the control it fails, and a CycloneDX cryptographic bill of materials (CBOM) for post-quantum planning.
Six categories, one inventory
- Certificates every X.509 certificate, who issued it, its strength, expiry, revocation and every place it is used
- Keys private-key files, SSH host keys, keystore entries, Windows certificate stores, cloud KMS and Key Vault keys
- Algorithms every public-key, signature, key-exchange, cipher and hash in use, with classical and quantum strength
- Protocols TLS and SSH versions offered, unencrypted services, and the protocol policy set on each host
- Libraries OpenSSL, GnuTLS, NSS, Java, .NET, Windows CNG, OpenSSH and more: version, end of life, post-quantum support
- Secrets API tokens, cloud access keys, passwords and connection strings in files, environments and repositories
Up and running in an afternoon
- 1
Sign up
Choose a plan and your organisation gets its own private workspace. Invite your team as administrators, members or read-only viewers.
- 2
Scan
Start with your public domains and internet-facing servers: nothing to install. For internal networks, run a small remote scanner inside each one; it connects out to PKIMap, so no inbound firewall rules are needed.
- 3
Report and fix
Download the reports and CBOM your auditors and architects need, see what to fix first, and schedule scans and expiry alerts to confirm each fix.
What PKIMap covers
Every paid plan includes the full scanner, the findings pages and NIST CSF 2.0 reports. A Consultant assessment includes these modules; Enterprise includes them all.
Compliance pack
All framework reports (PCI DSS, ISO 27001, the regional frameworks and the rest), their evidence, and attestations in the CBOM.
Included in an assessment →AD CS and Windows PKI
Active Directory Certificate Services checks (ESC1 to ESC15), who may enrol in each template, and the CA's own settings.
Included in an assessment →Cloud and DevOps
Scans of AWS, Azure, Google Cloud, Kubernetes, GitHub, GitLab and HashiCorp Vault with a read-only account.
Included in an assessment →Post-quantum readiness
The CBOM (CycloneDX 1.6) to download or view, for post-quantum migration planning.
Included in an assessment →Scheduled scans and alerts
Scans that repeat every day, week or month, and alerts before certificates expire.
Included in an assessment →Enterprise only
HSM and key management
Keys in hardware security modules over PKCS#11, Azure Managed HSM and AWS CloudHSM.
Apply for Enterprise pricing →Integrations
A versioned results API and signed event webhooks, so certificate lifecycle tools, ServiceNow, SIEM and ticketing systems act on what PKIMap finds: new certificates, where each is deployed, expiry and findings opened or fixed.
Apply for Enterprise pricing →Plans
Prices in US dollars. You pay for the hosts scanned, never for what is found: every certificate, key and secret on them is included. Local currency and tax are shown at payment.
Free
See what is out there: counts, not details
Free
- How much is found, and how serious, on up to 100 hosts
- 1 sensor, for 7 days
- Unlock the details with an assessment or Enterprise
Consultant
An assessment for one client
US$5,000per assessment
- Up to 1,000 hosts, for 30 days
- 3 sensors, tied to your laptops
- All modules and a branded Assessment report
Enterprise
Large or regulated organisations
POAprice on application
- Unlimited hosts
- Unlimited remote scanners
- Every module included, with HSM and Integrations
Built to be trusted with your keys
Read-only discovery
PKIMap looks; it never changes your systems. Cloud and directory scans use read-only accounts.
Your data stays yours
Each organisation has its own workspace that no other organisation can see. Saved passwords and keys are encrypted and never shown again. Private keys and secret values never leave the host: only certificates are copied.
Sign-in you control
Two-step sign-in with an authenticator app, passkeys, and single sign-on with Microsoft Entra ID, Google Workspace, Okta and other OpenID Connect providers. A security log records every sign-in to PKIMap.
See your cryptographic landscape today
Start on Free to see how much is out there, and unlock the details when you are ready.