A key inventory is a tracked list of cryptographic keys and their lifecycle status, such as creation date, owner, intended use, rotation schedule, and revocation state. It helps security teams know which keys can sign, decrypt, authenticate, or unlock systems, and who is responsible for them.
This matters because keys often outlive the projects and people that created them. Without an inventory, organizations may miss expired keys, leave old keys active, or fail to revoke keys after staff changes, migrations, or incidents. Defenders use key inventories to support rotation, cleanup, auditing, and incident response. Attackers benefit when inventories are missing, because forgotten keys can remain trusted and provide a quiet path to persistence or unauthorized access. Good key management turns cryptography from a hidden dependency into a controlled asset.