AgileSec Packaging Features Glossary

The following terms are used when describing AgileSec packaging features.

Term	Definition
AgileSec Platform	The central platform, which receives, stores, and analyzes cryptographic findings from Sensor and Connector scans presents inventory, performs risk analysis, and compiles reporting. The AgileSec Platform can operate in a hosted or customer-managed environment.
Deployment	How the AgileSec platform is hosted and operated. SaaS: Keyfactor hosts, operates, and updates the platform. Customers may need to deploy Sensors and Connectors or configure connections within their environment. On-Prem: The customer installs and operates the platform in their own data center or private cloud, using the agreed deployment architecture.
Production instance	Separate AgileSec production environments, each with its own data, users, and scope. Additional instances support requirements such as regional data residency, capacity beyond a single environment, or independently managed upgrades.
Non-production instance	A separate, non-production AgileSec environment for testing Sensor and Connector deployments, policy changes, and upgrades. No uptime commitment applies. Available on "Enterprise 360" and "Enterprise Governance" packages
Availability	The uptime commitment or resilience of an AgileSec deployment. SaaS: The production uptime commitment specified in the service agreement. On-Prem: Resilience provided by the deployment architecture and supporting infrastructure.
Data residency and hosting	Where AgileSec customer data is stored and processed. Shared, single-region: A multi-tenant service hosted in one region, with each customer’s data is separated and protected by tenant-specific encryption keys, stored and managed by Keyfactor in AWS KMS. Shared, multi-region (available on "Enterprise Governance" package): A multi-tenant service hosted across multiple regions, subject to availability and agreed data location requirements. Each customer’s data is separated and protected by tenant-specific encryption keys, stored and managed by Keyfactor in AWS KMS.
Single Sign On	Allows users to sign in to AgileSec through a supported identity provider. Account provisioning, permissions, and access removal depend on the configured identity integration and session controls.
Role-based access control	Controls determining what different user roles can do and which findings they can access. Fixed roles: AgileSec administrator AgileSec user
TLS Network discovery	Active scanning of network addresses to identify the certificates, TLS versions, cipher suites, and SSH algorithms each host presents. Measured in network IPs.
Application discovery	Scan supported application sources to identify cryptographic material and configurations. Scan source-code, artifact, and container repositories for Keys, certificates, and secrets stored in code or embedded in container images. Measured in Application Assets. Each repository, vault, key store, or database instance counts as one asset. Repositories are counted individually, rather than by organization.
Host discovery - Servers	Analysis of supported cryptographic material and configurations on a server, including files, keystores, TLS configuration, and TLS or SSH settings on server network interfaces. Associated network IPs are included in Server coverage. Measured by servers.
Host discovery - Desktop	Analysis of supported cryptographic material and configurations on licensed laptops and desktops. Measured by endpoints. Associated network IPs are included where the applicable licensing rules provide this coverage.
Asset Credits	Asset Credits (available on "Enterprise 360" and "Enterprise Governance" packages) are a shared pool of licensed capacity allocated across eligible asset types: Network IP or Desktop endpoint: 1 credit each. Application Asset or Server: 2 credits each. Covered Server and Desktop endpoints include associated network IPs at no additional credit cost. Only network IPs outside covered Servers and Desktops use separate credits.
Passive network discovery	Passive analysis of network traffic to identify the protocols and cipher suites in use. Licensed as a separate add-on with defined Sensor and capacity limits. Not covered by Asset Credits.
Scan initiation and automation	Start supported scan executions through the platform UI, remote command-line, or the Scan API (available on "Enterprise 360" and "Enterprise Governance" packages). Scan executions may be scheduled. Execution options depend on the source and Sensor/Connector.
Sensor	Direct discovery. A Sensor scans for cryptographic information directly on target host systems. Sensor scans search for and retrieve information across supported host systems, networks, repositories, EDR tools, and containers. Relevant Sensor types are included with the licensed asset module, while asset coverage remains subject to purchased capacity. Full list of supported Sensors can be found at: https://docs.keyfactor.com/agilesec/latest/sensors
Connector (Inbound)	Inbound discovery from another platform. A Connector uses another platform’s API to collect cryptographic information or related context for analysis in AgileSec (i.e. a vault, key manager, vulnerability scanner). Connector scans retrieve information from the source platform rather than inspecting a host directly. Full list of supported Connectors can be found at: https://docs.keyfactor.com/agilesec/latest/connectors
Native Keyfactor Connectors	Inbound from within Keyfactor's platforms. Supported connections to Keyfactor Command and CipherInsights do not count toward the third-party Connector allowance. Separate licensing and capacity requirements for the connected products still apply.
Third-party Connector allowance	Inbound from 3rd Party platforms. The number of licensed connections to supported non-Keyfactor systems included in a package. Sensors and native Keyfactor Connectors do not count toward this allowance.
Custom policy rules	Customer-defined rules to identify and flag cryptographic configurations not meeting required standards, such as deprecated algorithms, certificate validity periods exceeding permitted limits, or unapproved certificate issuers.
ServiceNow VR / USEM Integration	ServiceNow Vulnerability Response (VR) / Unified Security Exposure Management (USEM). Makes AgileSec cryptographic findings available as vulnerabilities and vulnerable items in ServiceNow Vulnerability Response Module for investigation and remediation. Available on "Enterprise 360" and "Enterprise Governance" packages.
Compliance and PQC readiness report	A report summarizing how findings for licensed asset types compare with configured policies and what they indicate about post-quantum cryptography readiness.
Cryptographic Bill of Materials (CBOM) Export	An export of supported cryptographic components and their details.
Export methodology	How data is exported from AgileSec: Manual: Download data from the console in supported formats, such as CSV or PDF. Search API (available on "Enterprise 360" and "Enterprise Governance" packages): Retrieve supported inventory records through the licensed API for use in external reporting and archiving tools.
Data retention	The period when historical findings and audit records are stored, including records of discoveries, changes, and user actions. Current configuration and inventory are retained according to the applicable subscription and data retention terms.