QScout Enterprise Buyer's Guide

QScout is a cryptographic-discovery and HNDL-scoring product. QScout public intake is requester-verified and operator-reviewed; QScout Surface, Silver, Gold, and Pulse are scoped assessment paths with explicit consent and governed evidence delivery.

Output is procurement-grade: every finding is traceable to its source, the scoring rubric is public, and governed evidence delivery follows the current capability manifest so downstream auditors can verify integrity without relying on marketing copy.

• CISO & security architects — quantifying HNDL exposure ahead of NIST CNSA 2.0 and NSM-10 deadlines.
• Procurement and TPRM teams — evaluating crypto posture of vendors and acquisitions.
• Audit and compliance leads — producing governed evidence for FIPS 203/204/205, PCI DSS 4.0.1, and HIPAA control frameworks.
• Boards and risk committees — board-ready quantum-risk reporting on a recurring cadence.

Every governed QScout path starts from declared buyer-approved scope. Public intake stays bounded; Surface, Silver, Gold, and Pulse add depth only when approved.

Public Intake — Approved Surface Signal

Requester-authorized public-surface family across up to 10 total authorized same-domain public hosts. No credentials, no penetration, no all-domain assessment claim.

QScout Surface — All Approved Public Domains

Paid unauthenticated external validation across all approved public domains: exposed locks, doors, services, panels, TLS, certificate posture, cryptographic controls, and outsider-reachable paths.

QScout Silver — Surface Plus Approved Credentials

Adds approved credentials and application, source, build, dependency, authenticated workflow, and integration evidence.

QScout Gold — Silver Plus Privileged Evidence

Adds privileged infrastructure, runtime, telemetry, CBOM, cryptographic inventory, and governed evidence packaging.

QScout Pulse — Continuous Intelligence After Approved Scope

Keeps approved QScout intelligence current with scheduled reassessment, event-triggered updates, drift reporting, and exposure-regression monitoring.

• Public intake: executive-safe public-surface signal, severity profile, HNDL signal, and proof boundary.
• QScout Surface: all-approved-public-domain external validation without credentials.
• QScout Silver: approved credentialed app, source, build, and dependency evidence.
• QScout Gold: privileged infrastructure, runtime, telemetry, CBOM, and governed evidence packaging.
• QScout Pulse: continuous cryptographic risk intelligence after approved QScout scope.
• Buyer briefing document tailored to the requesting role.

1. Request QScout assessment intake for approved public scope or a demonstration scope.
2. Sign the QScout MSA and statement of work. Scope and consent are explicit per environment.
3. Engagement begins on the agreed start date. Findings stream into the operator console as they land.
4. Final delivery includes the governed evidence pack and a procurement briefing for the requesting team.
5. Enterprise work starts through contact/ticket intake, then an operator provisions the approved engagement.

Is QScout the same as a vulnerability scanner?

No. QScout is a cryptographic-inventory and HNDL-scoring service. It is purpose-built for quantum-readiness reporting, not generic CVE enumeration.

Do you scan without consent?

Never. Scope and consent are the first artifacts of every engagement. Public-surface assessment work still requires a confirmed requester.

Can findings be independently verified?

Yes. Governed evidence delivery follows the published verification path and current capability manifest. A third-party auditor can re-run supported verification offline.

How does this fit with QStrike and QSolve?

QScout finds it. QStrike validates it. QSolve fixes it. The three share evidence formats so the discovery from QScout flows directly into governed validation and remediation workflows.