Support starts here

This is a real limitation and we would rather say so than pretend otherwise. A hardened Windows estate can block the collectors outright, and the block is doing its job.

You do not need our collector. It is a convenience, not the product. The assessment reads an inventory export you almost certainly already produce — from ServiceNow, Intune, SCCM, Tanium, Jamf, or rpm -qa and dpkg -l on Linux. Send that instead and nothing is lost.

If you would rather make the collector run, open a request: the answer depends on which control is stopping it, and we would rather look than guess.

Almost always a source-level SBOM — a list of one application’s own libraries rather than the operating system underneath it. The cryptography that matters for a certificate-standing question lives in the OS packages, so a manifest of an app’s dependencies genuinely cannot answer it.

This is usually a five-minute fix rather than a problem: open a request saying what produced the file and we will tell you exactly what to send instead. The tool stopping is the tool working. It is built to refuse rather than return a clean-looking result that means nothing.

Two common causes. A Windows inventory taken from HKLM only misses per-user installations — the current collector handles both. Or a container image with no OS layer, which has the same shape of problem as the SBOM answer above.

Tell us what produced the export and we will identify which it is.

Usually an export the tool could not match, or components newer than the snapshot dated in your bundle. Open a request with your license reference and what produced the export, and we will tell you which it is.

CSV or TSV from any CMDB or spreadsheet — comma, semicolon, tab or pipe, detected automatically. CycloneDX JSON, SPDX 2.x JSON, and SPDX 3.x JSON-LD. Column headings do not have to match ours; we accept the headings real exports actually use.

If your export is not read correctly, that is our defect and not your problem. Send us the header row — the column names only, no data — and fixing it is included.

Both statements are often true at once, and the gap between them is the whole point of the report. A vendor saying “we are FIPS validated” and a certificate naming the exact version you run are different facts. The second is the one an assessor cites.

The question worth putting to them in writing is narrow: does an active certificate name the exact version we are running? Your report writes that letter for you, per vendor.

If you believe the finding is simply wrong, say so — see the next answer, because we treat that seriously.

Tell us, and we will reproduce it before replying. We do not answer “the tool is right” without checking, because occasionally it is not.

A defect that makes a report wrong is handled as a security defect here, not as a routine question: we fix it, re-issue your report at no charge, and tell you exactly what changed and why. There is no tier that buys you this faster — it is the first thing we do.

The vendor holds an active certificate whose name strictly contains, or is contained by, the one that is retiring. That cannot be settled from a name in either direction. “Kernel Mode Cryptographic Primitives Library” contains every word of “Cryptographic Primitives Library” and is a different module — while a renamed product looks identical.

So we do not decide it, and we will not guess for you on a call either. Ask the vendor which one covers you; the report drafts that question.

Read it as a question, not a verdict. It means no successor certificate and no queue entry matched in a snapshot taken on a stated date. A certificate may have issued since, or been filed under a company name our matching did not join to the retiring one — corporate mergers make this genuinely hard.

It is not a finding about the vendor and we do not publish it as one. The honest action is to ask them in writing whether a submission exists for the product you own. That written answer is itself evidence, and worth more to an assessor than anything we could infer.

No — it is a real finding, and frequently the most important one in the report. It means the question “which validated module protects this data” currently has no answer on that system, which is a present-tense gap rather than a future one.

It is not grounds for a refund, and our terms say so plainly rather than leaving it to be discovered later.

No, and be wary of anyone who says yes. That determination belongs to your assessor or contracting officer. We are not a C3PAO and do not want to be — an organization that assessed you could not also sell you the preparation.

What we produce is evidence you bring to that conversation, early enough to act on. Who decides what sets out the boundary in full.

On a twelve-month license, yes — your whole estate, unlimited runs, as often as you like. Nothing expires, phones home, or counts you.

The $100 trial covers one machine and one report. If you have already run it and want the rest, the $100 comes off the $5,000.

The license carries a signature, and the tool declines to act on one it cannot verify rather than guessing. Usually the file was edited, re-saved by something that rewrote it, or copied incompletely.

Open a request with your license reference — the line at the top of the file — and we will re-issue it. Reformatting alone does not break it: indentation and key order are handled deliberately, so an editor that tidies JSON on save will not lock you out.

If we cannot produce a report at all from what you send, you get your money back. That one is not a judgment call.

The trial is refundable on request within thirty days, without argument.

A finding you dislike is not a refund — including “no validated cryptography found”, which is a real result. Anything else, talk to us; we look at those individually and settle quickly.

Not this page. Email security@agilicrypt.com and see our security policy for the acknowledgement and response windows.