From Detection to Defensible Inventory: Evidence Provenance, Cross-Layer Reconciliation and Uncertainty-Aware Risk Assessment for Legacy Cryptographic Discovery

Abstract The transition towards post-quantum cryptography requires organizations to identify and assess cryptographic assets distributed across heterogeneous information technology environments. Although cryptographic discovery mechanisms can identify certificates, configuration directives, cryptographic references, binary indicators and network observations, the presence of a detected artifact does not necessarily establish active cryptographic usage. Furthermore, findings collected from different discovery mechanisms may overlap, conflict or contain incomplete contextual information. Without systematic evidence provenance and reconciliation, these observations can produce misleading inventories and unreliable migration priorities. This paper presents an evidence-oriented methodology for constructing defensible cryptographic inventories through evidence provenance, cross-layer reconciliation and uncertainty-aware risk assessment. The proposed methodology emphasizes the preservation of source-level observations, classification of evidence according to its interpretation boundaries, consolidation of potentially related findings and explicit representation of unresolved uncertainty. It distinguishes detected artifacts and reported cryptographic references from independently confirmed runtime usage. A provisional risk-assessment model based on vulnerability, information lifetime and exposure is incorporated to support prioritization while keeping evidence confidence, contextual completeness and migration complexity as separate assessment dimensions. Findings without an available vulnerability classification remain unscored rather than being interpreted as low risk. The methodology is demonstrated using the six-layer CryptoScan research prototype, which incorporates certificate and key discovery, configuration analysis, job-script and command analysis, binary signature discovery, passive network metadata analysis and structured human-knowledge ingestion. All six scanners and the cross-layer reconciliation workflow were executed using controlled synthetic test fixtures. The latest independent execution produced 11 consolidated system-and-cryptographic-family-level inventory entries and 17 review flags. These results demonstrate functional and reproducible execution using controlled inputs; they do not establish production readiness, detection accuracy, asset-level identity resolution or independent validation of the proposed risk model. The study contributes an evidence-oriented methodological foundation for transforming heterogeneous cryptographic observations into traceable, reconciled and uncertainty-aware inventory records. It provides a basis for more defensible cryptographic assessment and informed post-quantum migration planning in legacy information technology environments.