The keys that never talk are still keys.
Mosaic walks the host itself — filesystems, keystores, certificate stores, SSH keys, configuration and the container images actually deployed — and reports the cryptography at rest that no amount of traffic capture will ever reveal.
Runs beside the network sensor on the same host. Together they produce one record of a system rather than two partial ones.
Traffic capture has a blind spot, and it is large.
A network sensor sees cryptography in use. It cannot see the expired certificate in a directory nobody opens, the private key with world-readable permissions, or the image built last year and still running.
Silence is not absence
A batch service that runs quarterly holds keys all year. It contributes nothing to a week of packet capture and everything to your risk.
The host has a name
On the wire a system is an address and a port. The host sensor reports the hostname, stable host identity and every IP it holds — which is the join key that turns two observations into one system.
Containers carry their own crypto
An image bakes in certificates, keys and libraries at build time. What is deployed on the host is the thing that matters, and it is often not what the registry currently holds.
Keystores hide in plain sight
JKS, PKCS#12, platform certificate stores, PKCS#11 tokens. Each has its own format and its own way of being missed by a generic file scan.
On the wire + on disk = one system
CADP fuses both views into a single subject. Neither sensor alone produces an inventory you can migrate from.
A thin fleet wrapper around proven discovery engines.
Mosaic does not reinvent filesystem crypto discovery. It bundles the scanning engines, adds the gap-fillers each operating system needs, and handles the parts a fleet actually requires: identity, enrolment, heartbeat and self-update.
Enrol
One enrolment token exchanges for a per-host key. The sensor registers itself with your CADP instance and appears in the fleet view.
Scan
Configured roots are walked for certificates, keys, keystores and configuration, and every container image on the local runtime is inventoried in the same pass.
Attribute
Every finding is rewritten to an absolute path and stamped with host identity, so an occurrence points at a real file on a named machine.
Ship
A CycloneDX CBOM per subject is posted to CADP, where it fuses with what the network sensor saw at the same addresses.
What it finds.
Coverage is hybrid and honest: a bundled engine does the broad work, and native gap-fillers handle what it demonstrably misses on each platform.
Certificates and keys
PEM and DER
X.509 certificates including weak and expired ones, and RSA, EC and Ed25519 private keys — with the permissions they are sitting under, which is frequently the more interesting finding.
Keystores
PKCS#12, JKS, platform stores
Java keystores, PKCS#12 bundles and the operating system's own certificate store, each read in its native format rather than guessed at from the file extension.
SSH host and user keys
RSA, ECDSA, Ed25519
Host keys and authorised keys across the estate. Ed25519 keys need a native gap-filler the bundled engine does not provide, so Mosaic ships one.
Container images
Docker and containerd, no registry pull
Every image present on the local runtime is scanned where it lives. On a container host this inventories the system files and the deployed images in a single pass, and it captures what is actually running rather than what a registry says should be.
Post-quantum material
ML-DSA, ML-KEM, SLH-DSA
Post-quantum keys and signatures are detected by object identifier, so ML-DSA and ML-KEM material on disk is classified as post-quantum rather than filed under unknown.
Configuration references
nginx, sshd and friends
A config file naming a cipher suite or pointing at a key is itself evidence. Mosaic reads the references, not just the files they point to.
Where an engine is known to miss something — encrypted private keys, PKCS#11 tokens, certain platform stores — that gap is documented and filled natively rather than quietly ignored.
Platforms and packaging.
Current shipping version 0.3.
| Platform | Packaging | Notes |
|---|---|---|
| Linux (glibc) | tar.gz, deb, rpm | systemd unit; x86-64 and ARM64 |
| Linux (musl) | tar.gz | Static build for minimal and appliance images |
| Windows | zip installer | Runs as a Windows service; reads the platform certificate store |
| FreeBSD | tar.gz | rc.d service |
| Solaris | tar.gz | SMF service |
| AIX | tar.gz | Validated against AIX 7.2 |
| Container hosts | same package | Scans local Docker and containerd images without pulling from a registry |
Every package is signed, and updates arrive through the same licensed, hybrid-signed channel as the rest of the platform. Air-gapped sites can stage releases from a local mirror.
What it does not do.
The same plainness we apply to the network sensor.
It is not an EDR agent
No process interception, no kernel module, no behavioural monitoring. It reads files and reports cryptography.
It does not exfiltrate key material
Public material, metadata, paths and fingerprints are reported. Private keys are identified, never transmitted.
It scans what you point it at
Roots are configured. It does not decide on your behalf to walk an entire filesystem, and it will not find crypto in a path it was never given.
Coverage is hybrid, not total
The bundled engine plus native gap-fillers cover the common cases well. PKCS#11 and HSM-resident material is reported as a reference, because by design it cannot be read off disk.
It does not judge
Like the network sensor, it reports observations. Classification and risk are CADP's, so policy changes never require touching the fleet.
Nothing leaves your environment
CBOMs go to your CADP instance and nowhere else.
One host, one scan, and the gap becomes obvious.
Install it on a single representative server and compare what it finds at rest against what the network saw that week. The difference is the part of the estate a traffic-only approach was never going to give you.