Evidence signature
Public signals bind to governed proof.
No customer data.
QScout proof sequence. Evidence Handshake. public-to-private proof path. No customer data.
Security & scan safety
See exactly how QScout separates the consented public-surface scan from governed, operator-led assessment depth — with signed evidence at every step.
In plain terms: QScout is a consented, non-penetrative scanner. It checks your public web, TLS, DNS and certificate surfacefor quantum-exposed cryptography — and only crosses into deeper, credentialed assessment after you approve the scope.
Frameworks mapped and Zoho Corporation-held inherited controls
The signal crosses the consent boundary only after authorization — then every artifact is governed and ML-DSA signed (NIST FIPS 204 post-quantum signature).
These are the quantum-computing platforms our threat model and validation work calibrate against — not customer references.
QScout Free starts only after requester authorization and business-email verification. The website snapshot is capped at the submitted domain and any verified same-domain public hosts.
The browser path runs public HTTP, TLS, DNS, certificate, email-crypto, and observable exposure checks. It does not exploit, authenticate, enumerate private assets, or behave like Surface.
Raw findings, cryptographic bill-of-materials (CBOM) output, signed bundles, and privileged evidence stay in operator-led scoped assessment lanes after buyer approval.
Contact/ticket intake starts governed procurement after scope alignment; legacy Marketplace routes are not a self-serve scan catalog or public rate card.
Assessment boundary
QScout Free stays browser-safe and capped. Surface, Silver, and Gold add all-domain public validation, credentials, and privileged evidence only when approved; QScout Pulse keeps the baseline current afterward.
24 public-surface modules across up to 10 total authorized same-domain public hosts.
All approved public domains and exposed assets, using consented unauthenticated external validation to check locks, doors, services, panels, cryptographic controls, and paths an outsider could use before credentials are introduced.
Surface plus approved credentials through application, source, build, dependency, authenticated workflow, and integration evidence.
Silver plus approved privileged infrastructure, runtime, telemetry, CBOM, cryptographic inventory, and governed evidence packaging.
Continuous cryptographic risk intelligence after a governed QScout baseline: scheduled reassessment, event-triggered updates, drift reporting, and exposure-regression monitoring.