NIST IR 8547 Quantum-vulnerable public-key algorithms are deprecated from 2030 and disallowed by 2035. Assess your exposure

Discovery & Risk Assessment

Elvas QScan
Quantum Readiness Scanner

You cannot protect what you cannot see. QScan gives security teams full visibility of their cryptographic attack surface. It finds every algorithm, key and certificate across networks, binaries and code, and turns that into a Cryptographic Bill of Materials and a risk-ranked migration plan.

Request a DemoView Architecture
qscan — sample output
$ qscan run --scope 10.20.0.0/16 --certs --binaries
[discover] probing TLS · SSH · IKE endpoints ....... done
[analyse ] fingerprinting crypto primitives ....... done
[cbom    ] cbom.cdx.json written (CycloneDX 1.6) .. done

ASSET               ALGORITHM         QUANTUM RISK
vpn-gw-01:500       RSA-2048 / DH14   ■■■■ CRITICAL
api.internal:443    ECDHE-P256        ■■■□ HIGH
fw-signing-key      ECDSA-P384        ■■■□ HIGH
backup-archive      AES-256-GCM       ■□□□ LOW

Overview

The problem QSCAN solves

Most organisations do not know where their cryptography lives. It is spread across load balancers, VPN concentrators, application libraries, firmware, HSMs and source code. That missing inventory is the single biggest blocker to post-quantum migration, and it is now an explicit requirement in frameworks such as PCI DSS v4.0.

Threats mitigated · MITRE ATT&CK

  • T1600 Weaken encryption
  • T1552.004 Exposed private keys
  • T1562.010 Downgrade exposure

Technical specifications

Discovery
TLS · SSH · IKE probing, X.509 / PKCS#12, binaries, source
Output
CBOM (CycloneDX 1.6), JSON, executive PDF report
Risk model
Mosca's inequality, NIST IR 8547 timelines
Coverage
On-premise, cloud and hybrid estates
Interfaces
CLI, REST API, CI/CD pipeline integration
Compliance mapping
PCI DSS 12.3.3, ISO 27001 A 8.24, CNSA 2.0

Architecture

Discovery-to-remediation pipeline

Discovery-to-remediation pipelineQSCAN
Network endpoints X.509 certificates Binaries & libraries Source code KMS / HSM / PKI QScan Engine protocol probing fingerprinting CBOM builder risk model CBOM CycloneDX 1.6 Risk scores per asset · per system Migration plan prioritised roadmap

Capabilities

Built for security teams, engineered for scale

01

Active protocol probing

Enumerates TLS, SSH and IKE endpoints and records the negotiated key exchange, signature and cipher suites.

02

Crypto fingerprinting

Detects cryptographic libraries and primitives in binaries, containers and source repositories.

03

Standards-based CBOM

Exports a machine-readable inventory in CycloneDX format for audit, compliance and tooling.

04

Quantum risk scoring

Scores each asset using Mosca's inequality and NIST IR 8547 deprecation timelines.

05

Exposed-key discovery

Flags private keys and certificates stored insecurely, weak or expired, before attackers find them.

06

Continuous drift detection

Repeat scans highlight new quantum-vulnerable cryptography introduced after migration.

Use cases

Where QSCAN protects you

Board-level risk baseline

Quantify quantum exposure across the organisation and report it in business terms.

Regulatory evidence

Produce the cryptographic inventory auditors increasingly expect, on demand.

Migration tracking

Measure progress against your roadmap with repeatable, comparable scans.

See Elvas QScan in action

Book a technical demonstration with our engineers and discuss your deployment.

Request a Demo Explore the Platform