Source scanners, SBOMs, certificate managers, network monitors, and vendor questionnaires each answer a different question, and none of them inspects the cryptography inside the software you actually ...