Consent before checks
QScout Surface starts only after requester authorization and business-email verification. The approved public-surface snapshot is capped to explicitly approved hosts.
Security & assessment safety
The boundary is proven before deeper access is asked.
See exactly how QScout separates consented public-surface intake from governed, operator-led assessment depth — with inspectable evidence boundaries at every step (bounded by the live capability manifest).
In plain terms: QScout is consented, non-penetrative assessment intake. It reviews your public web, TLS, DNS and certificate surfacefor quantum-exposed cryptography — and only crosses into deeper, credentialed assessment after you approve the scope.
Public intake is authorized, non-penetrative, and bounded to approved scope.
boundary state · governed evidenceGOVERNED
The signal crosses the consent boundary only after authorization. Public score-signing rollout remains staged; governed artifacts stay in controlled evidence lanes.
consent gatenon-penetrativegovernedstaged signing
Ecosystem contextIBM QuantumIonQQuantinuumRigetti
These are the quantum-computing platforms our threat model and validation work calibrate against — not customer references.
No penetration in public intake
QScout Surface reviews public HTTP, TLS, DNS, certificate, email-crypto, and observable exposure evidence. It does not exploit, authenticate, enumerate private assets, or behave like QScout Silver or QScout Gold.
Artifacts stay governed
Raw findings, cryptographic bill-of-materials (CBOM) output, signed bundles, and privileged evidence stay in operator-led scoped assessment lanes after buyer approval.
Procurement is controlled
Contact/ticket intake starts governed procurement after scope alignment; legacy Marketplace routes are not a self-serve catalog or public rate card.
Signed-proof & compliance evidence
The signing posture is shown as its actual governed state.
ML-DSA-65 signing is present and self-test verified; public signed-artifact delivery stays staged until it is enforced on the public path. The platform maps to 15compliance frameworks — aligned to, not certified.
Signed-Proof & Compliance Posture· ML-DSA-65FIPS 20415 frameworks
Illustrative · Signing posture— not live customer telemetry
Enforced on the public pathVerified capability presentStaged not yet enforced
ML-DSA-65 signing capabilityFIPS 204 post-quantum signature schemeVerified
Signer self-testSign/verify self-test on the governed signerVerified
Public artifact deliveryRequester-accessible signed proof packs on the public pathStaged
Public report labelPublic intake delivers the Executive Snapshot SummaryEnforced
Frameworks · aligned to, not certified15 mapped
- NIST CSF 2.0
- NIST SP 800-53 Rev. 5
- PCI DSS 4.0.1
- HIPAA
- SOC 2 Type II
- ISO 27001:2022
- FedRAMP Rev 5
- CMMC 2.0
- GDPR
- GLBA
- ITAR
- SOX
- SWIFT CSP v2026
- CNSA 2.0
- NIST SP 800-131A Rev. 2
ML-DSA-65 signer present · public delivery stagedgoverned status: artifact_delivery_unavailable
No customer telemetry is used. Synthetic placeholders only.
Assessment boundary
Five QScout paths, one authorization rule.
QScout Surface stays browser-safe and capped. QScout Silver and QScout Gold add credentialed and privileged evidence only when approved; QScout Pulse keeps the baseline current afterward.
QScout Surface
74-module governed catalog available after approved scope; Surface covers approved public-surface evidence first.
QScout Silver
Surface plus approved credentials through application, source, build, dependency, authenticated workflow, and integration evidence.
QScout Gold
Silver plus approved privileged infrastructure, runtime, telemetry, CBOM, cryptographic inventory, and governed evidence packaging.
QScout Pulse
Continuous cryptographic risk intelligence after a governed QScout baseline: scheduled reassessment, event-triggered updates, drift reporting, and exposure-regression monitoring.