# Can a network sensor build a cryptographic inventory?

A large part of it, yes, but not all of it. Every TLS connection announces, before any encryption starts, which key-exchange groups the client offers and which one the server picks, as well as the TLS version; SSH works in a similar way. A sensor that sees those handshakes can list, per server and per client, where quantum-vulnerable key exchange is still used and where hybrid post-quantum key exchange already is, for every device on the segment, including printers, appliances and machines that cannot run an agent. What it cannot see: cryptography inside applications and databases, keys and certificates stored on disk, code signing, encrypted backups, segments that are not monitored, and connections whose handshake never crosses the sensor. NQCI, the NetSenX crypto inventory (in preview), is visible on every plan and active from the Pro plan; it needs the packet-capture sensor, off by default, switched on for a Linux agent or a sensor on a SPAN or TAP port. The basic macOS mode does not see handshakes. Combine it with a certificate inventory and supplier questionnaires.

FAQ: [Post-quantum cryptography](https://netsenx.com/en/faq/pqc) · https://netsenx.com/en/faq/can-a-network-sensor-build-a-cryptographic-inventory

## Read next

- https://netsenx.com/en/encrypted-traffic-analysis
- https://netsenx.com/en/features
- https://netsenx.com/en/blog/2026-10-27_harvest-now-decrypt-later

## Related questions

- [How do I find which connections already use hybrid key exchange?](https://netsenx.com/en/faq/which-connections-already-use-hybrid-key-exchange)
- [What should a cryptographic inventory include?](https://netsenx.com/en/faq/what-should-a-cryptographic-inventory-include)
- [Does NetSenX protect us against quantum computers?](https://netsenx.com/en/faq/does-netsenx-protect-us-against-quantum-computers)
- [How do we answer an RFP question about post-quantum readiness?](https://netsenx.com/en/faq/how-to-answer-an-rfp-question-on-post-quantum-readiness)
- [What should we ask vendors about post-quantum readiness?](https://netsenx.com/en/faq/what-to-ask-vendors-about-post-quantum-readiness)