Free options include Vista Platform Core for a self-hosted operational inventory and scoped CBOMs, CBOMkit for supported source-code cryptography, cdxgen for project-oriented BOM generation, and testssl.sh for TLS endpoint inspection. Choose by the evidence you need to collect. These tools have different coverage and are not interchangeable.
This comparison is maintained by Vista Security, the maker of Vista Platform. It summarizes the projects’ published documentation as reviewed on October 7, 2026; it is not an independent benchmark. Check the linked documentation for current versions, supported ecosystems, and license terms.
On a narrow screen, scroll the table sideways to see all columns.
| Tool and license | Useful starting point | Output and boundary |
|---|---|---|
| Vista Platform Core Free; proprietary platform | Bring supported network, host, device, and cloud evidence into an operational inventory you host. | Canonical inventory and scoped CycloneDX CBOMs. Coverage depends on connected sources, permissions, and observations. |
| CBOMkit Open source; Apache-2.0 | Find cryptographic use in supported source repositories, then view and evaluate CBOMs. | CBOM generation and visualization. Supported languages, libraries, and build context determine code coverage. |
| cdxgen Open source; Apache-2.0 | Generate BOMs from software projects and use its documented cryptography collection options. | CycloneDX output. CBOM evidence varies by ecosystem; broad SBOM support does not imply identical cryptography coverage. |
| testssl.sh Open source; GPL-2.0 | Inspect a reachable service’s offered TLS/SSL protocols and ciphers. | Endpoint reports, including JSON and CSV. A TLS report is not an estate-wide inventory or automatically a CycloneDX CBOM. |
If you need to understand cryptography in source code
Start with the languages and cryptographic libraries your application uses. CBOMkit documents its supported combinations and limitations when code has not been built. cdxgen documents CBOM options separately from general SBOM generation. Try a representative project with known cryptographic calls and inspect what is detected before expanding to all repositories.
Sources: CBOMkit coverage and cdxgen advanced usage.
If you need to inspect a TLS service
A focused endpoint tool can answer which protocols and ciphers a reachable service offers. testssl.sh runs from a command line and supports machine-readable results. Its observations describe the endpoints and conditions tested; they do not establish what applications, host keystores, or cloud accounts contain elsewhere.
Source: testssl.sh documentation. Only test endpoints you are authorized to assess.
If you need an inventory to operate over time
Vista Platform Core is a fit when you want to connect observations to asset identity, investigate cryptographic configurations, evaluate posture, and generate evidence for a defined Scope. The operating loop is discovery, canonical inventory, evaluation, action, and proof. Begin with one supported source and expand as you verify coverage.
Vista Platform Core is a free, self-hosted infrastructure inventory, DCIM, and IPAM platform with cryptographic posture built in. It includes discovery, the internal infrastructure workspace, compliance and PQC assessment, and CBOM generation without asset, sensor, seat, or time caps. You provide the infrastructure and operate it. Core is proprietary software under the Vista Platform License, version 1.0. The sensor and device interrogation agent are open source under Apache-2.0.
Core includes CycloneDX CBOM export. Enterprise adds PDF/SPDX downloads, signing, attestation, comparison, and other paid capabilities. See the release-specific CBOM documentation and edition overview.
Five checks before choosing
- Collection boundary: code repository, endpoint, host, device, cloud account, or several of these?
- Access: which traffic, credentials, interfaces, and permissions will collection require?
- Evidence: can you trace a result to a source and observation time?
- Export: do you need JSON findings, a schema-valid CBOM, or an inventory with operational context?
- Gaps and cost: what remains unobserved, and who operates the infrastructure? Free software still requires time and compute.
You may need several tools to answer different questions. Do not assume their outputs can be imported into one another without checking supported formats and mappings. No single empty scan establishes the absence of cryptography.