A defensible inventory
See systems, protocols, and cryptographic dependencies in one governed evidence set.
Find · cryptographic exposure intelligence
Find the cryptography that creates tomorrow’s risk.
See where cryptography is exposed—and what must move first. QScout turns approved scope into a decision-ready view of exposed cryptography, sensitive-data lifetime, quantum urgency, and the systems that should move first.
The decision
Where is vulnerable cryptography, what data stays sensitive long enough to matter, and what should we migrate first?
QScout · exposure map
Illustrative · not customer telemetry
Qtonic Quantum Corp · CBOM Exposure Map
Discovery to CBOM
- 01 sample stage sample stage Approved scope asset
Long lived records service
The assessment boundary and accountable system owner are recorded first.
- 02 sample stage sample stage Observed dependency
RSA-2048 · TLS (sample modeled)
QScout records the dependency in a CycloneDX 1.7 CBOM where approved.
- 03 sample stage sample stage Exposure decision
Confidentiality window past plan
Data lifetime and migration timing establish the harvest now priority.
- 04 sample stage sample stage QScout output
Owner · evidence · priority
The record becomes a governed input to validation and migration planning.
QScout outcomes
What the buyer can decide next
Materiality, not a list
Connect exposure to data lifetime, business context, and harvest-now risk.
A migration starting point
Give owners an ordered path into validation and remediation planning.
Why QScout
The product truth that makes this step distinct
Governed assessment depth
QScout uses a governed 74-module catalog across Surface, Silver, and Gold. Surface, Silver, and Gold map to 46, 57, and 74 cumulative modules. The governed catalog is 74 modules. Availability still depends on approved scope.
One continuous report family
QScout Pulse carries approved evidence forward across the governed QScout tiers; it is not a fourth flagship product.
Framework mapping, not certification
Findings can map to a scoped subset of 15 enterprise framework families. A mapping is evidence context, never a certification claim.
Operating method
Three governed assessment moves
- 01
Approve scope
An operator confirms authorization and the assessment boundary before work starts.
- 02
Collect evidence
QScout examines the approved surface and separates observations from validated findings.
- 03
Deliver the decision record
Leaders receive evidence, prioritization, and CBOM output where the engagement approves it.
Proof receipt
Claim, method, state, and limit—in one place
Bounded product truth. No customer telemetry in this public view.
- Claim
- QScout maintains a governed assessment catalog and produces CycloneDX CBOM output where approved.
- Scope
- Approved-scope QScout assessment evidence and CBOM output; not an unrestricted public scan.
- Method
- Read the product truth registry, module catalog, and representative QScout report structure.
- Artifact
- 74-module catalog · CycloneDX 1.7
- Freshness
- Product canon bound to website build 609c7e1629d0.
- Status
- documented
- Limitation
- Module availability depends on approved scope. Mapping is not certification, and the public site does not run an unrestricted scan. Workflow connectors (Jira / ServiceNow) are one-way ticket creation and dry-run by default today.
Governed intake
Assessment begins with authorization.
The intake captures business context only. Qtonic Quantum Corp confirms requester authority and approved scope before assessment work runs.
What a full run covers (preview)
Not a self-serve public scan. After authorization, assessment work uses the governed catalog: Surface 46 · Silver 57 · Gold 74 cumulative modules.
- Surface: 46
- Silver: 57
- Gold: 74