Maturity Levels

Level 1

Visibility Layer

Minimal Disruption

Passive discovery from validation traffic with no change in current issuance. 3AM distributes trust stores and routes CRL/OCSP validation while existing issuance paths remain untouched.

Data Flows:

• Trust store / client repository distribution
• Network and host discovery by software clients
• (Optional) CRL/OCSP traffic through 3AM

Level 2

Issuance Bridge

Centralized Control

Level 3

Policy Control

Governance Layer

Level 4

Zero-Touch Intelligence

Executive Oversight

Visibility Layer

Passive discovery from validation traffic (no change in current issuance)

Trust/Validation

3AM CENTRAL HUB Web Clients Browsers / Apps Agents Servers / IoT Services Microservices Internal PKI Enterprise CA Public CAs e.g., Digicert, Sectigo Cloud CAs AWS / Azure / GCP CMDB ServiceNow / Jira Trust Store Clients Direct Issuance (Bypasses 3AM)

• Clients → 3AM
• 3AM → CAs
• 3AM ↔ CMDB
• 3AM → Exec