Scheduled reassessment
Re-run the QScout evidence model on a defined cadence so cryptographic posture stays current instead of aging into a stale point-in-time report.
OMB M-26-15 is here - plan window due
Federal agencies have until Oct 22, 2026 to submit PQC Migration Plans. Qtonic Quantum Corp helps produce cryptographic inventory, CBOM-grade visibility, and prioritization evidence.
QScout Gold Pulse by Qtonic Quantum
Point-in-time crypto reports go stale during multi-year migrations — Pulse tracks that drift.
Approved scope tells you where you stand today. QScout Gold Pulse by Qtonic Quantum tells you the moment that changes — scheduled reassessment, event-triggered updates when a certificate rotates or a domain appears, and drift reporting when posture regresses.
Not a SOC replacement. Not attack detection. Pulse keeps QScout intelligence current, explainable, and decision-ready after approved scope.
QScout Gold Pulse, stated plainly: the governed catalog at Gold depth — all 74 modules — executed continuously instead of once. Run that way the deliverable stops being a report that ages and becomes a digital twin of the approved cryptographic estate: one evidence record, re-derived on cadence and on event, describing the estate as it stands rather than as it stood on assessment day. QScout uses a governed 74-module catalog across Surface, Silver, and Gold.
Always-current intelligence for cryptographic risk
Event-based updates
Promote new findings when certificates, keys, libraries, vendors, or public attack conditions materially change.
Drift reporting
Show what changed, why it matters, and whether the change increases migration pressure or board exposure.
Leadership-ready outputs
Keep the board, CISO, and operating teams on one current view instead of passing around stale PDFs.
What it is not
- Not endpoint telemetry or SOC alerting.
- Not a replacement for an initial QScout Surface, Silver, or Gold assessment.
- Not a promise that public cryptographic risk will stay static between board meetings.
What you get
- Scheduled and event-triggered reassessment cadence
- Evidence-backed change log across public cryptographic posture
- Enterprise-evidence summaries of new exposure, drift, and urgency
- Escalation path into QStrike validation and QSolve migration planning
M-26-15 continuous monitoring
QScout Gold Pulse for multi-year migration drift
PQC migration is a multi-year operating program. QScout Gold Pulse helps track posture drift, migration progress, third-party readiness, and executive reporting indicators.
Evidence
Recurring posture evidence
Evidence
Migration progress signals
Evidence
Executive reporting cadence
Why it is required, not optional
The mandates require cryptographic inventory and migration reporting — continuous monitoring keeps that evidence current.
The obligation is standing
OMB M-23-02 requires a prioritized cryptographic inventory and annual migration reporting; CNSA 2.0 sets PQC transition timelines for national-security systems; NIST IR 8547 (initial public draft) describes deprecating 112-bit security after 2030. Continuous monitoring keeps that inventory and reporting evidence current.
Harvest-now-decrypt-later is active
Adversaries capture encrypted data today to decrypt at a cryptographically-relevant quantum computer. Every day on classical cryptography widens the exposure window — periodic review cannot catch a regression the day it happens.
Migration is multi-year, multi-owner
Without a continuous instrument it is harder to document progress for a board, an auditor, or a command; to catch cryptographic drift; or to show the program is on track.
From evidence to decision
Six monitored dimensions, each mapped to a decision — with owner, traceable evidence, and closure.
Quantum Risk
What classical cryptography is exposed — prioritize the migration queue.
HNDL
Which long-lived / sensitive data is harvestable now — shorten the window first.
Cryptographic Debt
The legacy backlog burn-down rate — hold the migration pace.
Cryptographic Strength
QScout strength-tier migration (Silver→Gold) toward hybrid, then post-quantum.
Nation-State Threat
Adversary pressure on your cryptography — re-prioritize under attack.
Audit & Discovery
Coverage and freshness — close residual blind spots.
Built for the buyers who must migrate
Fortune 1000, government, and defense — each gets the evidence their mandate demands.
Fortune 1000 & enterprise
Board and regulator reporting; spend prioritized to the highest exposure.
A continuous crypto-risk posture, a prioritized migration queue, and traceable evidence designed to support auditor review — reusable for board, SEC governance, and risk-committee reporting.
Government & agency
OMB M-23-02 cryptographic inventory, prioritization, and annual reporting.
Standards-aligned inventory + prioritization + continuous reporting, with traceable evidence records you attach to a POA&M and reuse for attestation. Methodology mapped to NIST IR 8547 (initial public draft) / FIPS 203-205 / CNSA 2.0.
Military & defense
Nation-state harvest-now-decrypt-later against mission cryptography.
A continuous watch on the harvest window and adversary pressure, an HNDL model tied to data sensitivity and exposure duration, and traceable assurance evidence designed to support command and authorization review.
Standards crosswalk
What the mandate requires — and how Pulse produces it.
| Requirement | How Pulse helps |
|---|---|
| OMB M-23-02 — maintain a prioritized cryptographic inventory | Continuous inventory of observed cryptography with risk prioritization and owner assignment. |
| OMB M-23-02 — report migration progress annually | Traceable, time-stamped migration-state evidence and trend, exportable for reporting. |
| CNSA 2.0 / NIST PQC — transition to approved algorithms | Silver→Gold strength tracking toward FIPS 203/204/205 (ML-KEM, ML-DSA, SLH-DSA). |
| NIST IR 8547 (initial public draft) — describes deprecating 112-bit by 2030 and disallowing it by 2035 | Continuous planning horizon to the deprecation window; flags exposure against it. |
Honest scope
What's available today, what's via engagement, what's roadmap.
Available today
Assessment from consented public surfaces (TLS / certificate / header metadata); the continuous Pulse instrument; published evidence-state labeling; published methodology.
Via scoped engagement
Internal, cloud, and PKI discovery beyond public surfaces; mission / enclave assessments; tailored readiness reviews.
On the roadmap
Systems-of-record integrations and exports; expanded accreditation posture — stated honestly, not implied as turnkey.
Every Pulse finding carries a confidence score with its basis and traceable source lineage, so the evidence is designed for verification rather than assertion.
Keep one current view between major assessments.
QScout Gold Pulse keeps approved QScout findings current through scheduled reassessment, drift reporting, and event-triggered updates.
- Scheduled reassessment keeps boards, CISOs, and operators on one current view.
- Evidence-backed drift reporting shows what changed, why urgency increased, and when escalation into QStrike or QSolve is warranted.
Product-owned next step
Scope the continuous layer around your approved QScout assessment.
Start with a scoping conversation if you need a continuously current intelligence layer between major assessments.
QScout Gold Pulse begins after approved QScout scope. It is an always-current intelligence layer, not a SOC replacement or attack-detection platform.