Discover
Networks, Windows and Linux servers, AWS, Azure, Google Cloud, Kubernetes, GitHub, GitLab, HashiCorp Vault and HSMs. Public certificates for your domains from certificate transparency logs, with nothing to install.
Cryptographic inventory & post-quantum readiness
Find every certificate and key before it causes an outage
PKIMap builds one inventory of the certificates, keys, secrets and encryption across your networks, servers and clouds, tells you what to fix first, and produces the reports your auditors accept.
Free plan: up to 25 internet-facing assets. No card needed.
One map of everything cryptographic you run
Certificates expire, keys leak, and old algorithms linger long after anyone remembers where they are. PKIMap finds them, ranks them and shows the evidence.
Prioritise
Expired and expiring certificates, weak keys and algorithms, private keys anyone can read, secrets in plain text, risky Active Directory certificate templates, and what is not ready for post-quantum. Ordered by what to fix first.
Prove
Compliance reports for NIST CSF 2.0, PCI DSS, ISO/IEC 27001 and regional frameworks, each finding linked to the control it fails, and a CycloneDX cryptographic bill of materials (CBOM) for post-quantum planning.
Six categories, one inventory
- Certificates every X.509 certificate, who issued it, its strength, expiry, revocation and every place it is used
- Keys private-key files, SSH host keys, keystore entries, Windows certificate stores, cloud KMS and Key Vault keys
- Algorithms every public-key, signature, key-exchange, cipher and hash in use, with classical and quantum strength
- Protocols TLS and SSH versions offered, unencrypted services, and the protocol policy set on each host
- Libraries OpenSSL, GnuTLS, NSS, Java, .NET, Windows CNG, OpenSSH and more: version, end of life, post-quantum support
- Secrets API tokens, cloud access keys, passwords and connection strings in files, environments and repositories
Up and running in an afternoon
- 1
Sign up
Choose a plan and your organisation gets its own private workspace. Invite your team as administrators, members or read-only viewers.
- 2
Scan
Start with your public domains and internet-facing servers: nothing to install. For internal networks, run a small remote scanner inside each one; it connects out to PKIMap, so no inbound firewall rules are needed.
- 3
Report and fix
Download the reports and CBOM your auditors and architects need, see what to fix first, and schedule scans and expiry alerts to confirm each fix.
Add the modules you need
Every plan includes the full scanner, the findings pages and NIST CSF 2.0 reports. Add modules to Team or Business as you need them; Enterprise includes them all.
Compliance pack
All framework reports (PCI DSS, ISO 27001, the regional frameworks and the rest), their evidence, and attestations in the CBOM.
Add to a plan →AD CS and Windows PKI
Active Directory Certificate Services checks (ESC1 to ESC15), who may enrol in each template, and the CA's own settings.
Add to a plan →Cloud and DevOps
Scans of AWS, Azure, Google Cloud, Kubernetes, GitHub, GitLab and HashiCorp Vault with a read-only account.
Add to a plan →HSM and key management
Keys in hardware security modules over PKCS#11, Azure Managed HSM and AWS CloudHSM.
Add to a plan →Post-quantum readiness
The CBOM (CycloneDX 1.6) to download or view, for post-quantum migration planning.
Add to a plan →Scheduled scans and alerts
Scans that repeat every day, week or month, and alerts before certificates expire. Included in Business.
Choose Business →Enterprise only
Integrations
A versioned results API and signed event webhooks, so certificate lifecycle tools, ServiceNow, SIEM and ticketing systems act on what PKIMap finds: new certificates, where each is deployed, expiry and findings opened or fixed.
Apply for Enterprise pricing →Plans
Prices in US dollars per organisation, billed yearly. Local currency and tax are shown at payment. Change plan at any time.
Free
Try it on your internet-facing systems
Free
- 25 assets
- Internet-facing systems (no remote scanners)
- NIST CSF 2.0 reports
Team
One IT or security team
US$6,000per year
- 1,000 assets
- 2 remote scanners
- Add modules as you need them
Business
A company with several sites
US$18,000per year
- 5,000 assets
- 10 remote scanners
- Includes Scheduled scans and alerts
Enterprise
Large or regulated organisations
POAprice on application
- Unlimited assets
- Unlimited remote scanners
- Every module included
Results you have already found are never hidden or deleted because of a plan.
Built to be trusted with your keys
Read-only discovery
PKIMap looks; it never changes your systems. Cloud and directory scans use read-only accounts.
Your data stays yours
Each organisation has its own workspace that no other organisation can see. Saved passwords and keys are encrypted and never shown again. Private keys and secret values never leave the host: only certificates are copied.
Sign-in you control
Two-step sign-in with an authenticator app, passkeys, and single sign-on with Microsoft Entra ID, Google Workspace, Okta and other OpenID Connect providers. A security log records every sign-in to PKIMap.
See your cryptographic landscape today
Start on Free with your internet-facing systems, and move up when you are ready.