Discover · CipherScout™
Cryptographic discovery across your entire estate
CipherScout detects cryptographic posture across your network, certificates, applications and data layer, then consolidates everything into a single CycloneDX 1.7-aligned Cryptographic Bill of Materials (CBOM).
Why CipherScout
Over 50 proprietary scanners across 10 surfaces
CipherScout goes deeper than a cryptographic inventory. It maps your network topology to find assets you did not know you had, scores every finding for quantum risk, generates reports for every audience from the SOC to the board, and runs entirely on-premises when your estate demands it.
Beyond the known estate
Network topology that finds what you missed
Most scanners audit the targets you declare. CipherScout also discovers the ones you did not know about: network discovery, DNS enumeration and topology enrichment surface hosts, services and cryptographic assets across your estate before the scan even begins. The result is an inventory of what you actually run, not what you thought you ran.
Quantum risk scoring
Every finding scored for quantum risk
Each finding receives a severity score (critical, high, medium, low) based on its quantum vulnerability, mapped to a NIST control reference. Configurable impact profiles (low-impact, standard, aggressive) let you tune scan intensity for sensitive or OT-adjacent networks, so discovery stays safe where it matters most.
Reports for every audience
From the SOC to the boardroom
Five built-in report types: a Technical report for your security team, an Executive summary for leadership, a Board report for governance committees, a full CBOM export (CycloneDX 1.7, JSON, CSV, PDF) and a Custom Query report for ad-hoc analysis. AI-assisted reporting is available as a marketplace add-on with your own Anthropic, OpenAI or Google key.
Sovereign by design
Full on-premises discovery with posture tracking
The on-premises box runs the complete scanner suite inside your network: discovery, topology mapping, blast-radius analysis and posture history over time. Scan data stays within your boundary, and the box tracks how your cryptographic posture changes across every scan, so drift is visible before it becomes exposure.
On-premise deployments actually take 5 minutes
Download the signed bundle, verify it, run it. Most clients start on cloud for an initial external assessment, then deploy the on-premises box for the full internal scan. No custom infrastructure, no professional services. Five minutes from download to first scan.
Every surface, in depth
Each surface is a distinct scanner target that feeds into the CBOM. Here is what CipherScout finds on each one.
Deep TLS visibility
Live PQC Hybrid Group Detection
CipherScout detects whether a server has already deployed post-quantum hybrid key exchange, including the ML-KEM hybrid groups recommended by NIST and IETF, directly from a live TLS session. Most scanners report only protocol version and cipher suite. CipherScout goes a level deeper, surfacing whether the server is already making the transition.
Certificate inventory
Certificate Discovery & Risk Assessment
CipherScout retrieves and analyses every certificate presented across your estate, including algorithm type, key size, signature method, issuer chain and expiry, across HTTPS, SMTPS, LDAPS and any other certificate-presenting service. Each certificate receives a Quantum Health Score reflecting its vulnerability to Shor’s algorithm. The output is a complete, prioritised certificate inventory your PKI and infrastructure teams can act on directly.
API authentication layer
API Authentication Cryptography Assessment
APIs authenticate callers using cryptographic mechanisms such as token signing algorithms, key types and OIDC configurations that are rarely audited at the cryptographic level. CipherScout analyses the algorithm commitments your APIs make to every relying party, combining JWKS, OIDC metadata and TLS posture into a composite quantum vulnerability score for each API authentication surface.
SSH infrastructure
SSH Host Key Assessment
Every SSH server advertises public host keys that clients use to verify its identity. If those keys use quantum-vulnerable algorithms (with RSA being the most common), the administrative access path to your entire server estate is exposed. CipherScout connects to SSH endpoints and reads the advertised host key types and fingerprints without authenticating, without interacting beyond the key exchange phase, and without collecting any credentials or session content.
Underscanned surfaces
Full Email Cryptography Inventory
Email infrastructure carries its own cryptographic footprint: signing keys, authentication mechanisms and transport security. CipherScout assesses the full email cryptographic surface in a single pass, including the signing algorithms protecting outbound mail and the certificate properties of signed messages (S/MIME). No email content is read; only the encryption used to protect it.
Live, not static
Fleet-Wide JWT Posture Analysis
CipherScout connects directly to the user’s token database and analyses the entire JWT population in bulk. Algorithm distribution, header injection risk indicators, claim completeness and worst-case Quantum-Health Score (QHS) across the fleet. The output is a compliance view rather than an individual token report.
Data layer coverage
Database Transport & Auth Crypto
For declared database targets, CipherScout assesses how data is protected in transit and at rest, covering the encryption on the connection itself, the authentication mechanism in use and replication security. Assessment is scoped strictly to customer-declared systems, keeping the tool within compliance auditing.
Cloud key inventory
Cloud Key Management Inventory
CipherScout retrieves key algorithm, rotation status, expiry and configuration metadata from cloud key management services across major providers and custom private cloud environments. Access is strictly read-only, and no key material is accessed or returned at any point.
Codebase visibility
Source Code Cryptographic Analysis
CipherScout scans customer-supplied source code to identify where classical cryptographic algorithms are used across the codebase, including legacy hash functions, deprecated key types and hardcoded cryptographic material. Findings pinpoint exact file locations, giving development teams an actionable list rather than a summary.
Hardware
Device & Edge (including IoT, OT, Air-Gapped)
CipherScout can be deployed on-premises to scan local certificates, keys and other encryption in devices at the hardware and OS levels. It can be deployed in devices as well as IoT, OT and air-gapped systems to find and inventory their cryptography.
How it works
How a CipherScout scan works
Define a target, run the scan, get a structured inventory. CipherScout maps what you run rather than exploiting it, so you can scan sensitive and OT-adjacent networks safely.
01 · Target
Define the scope
Set the target: a domain, an IP range, a certificate authority or a cloud key store. Scans are target-bound and egress-guarded, so discovery stays measured and within scope.
02 · Scan
Run the discovery
CipherScout maps what you run rather than exploiting it. Around 50 proprietary scanners surface the protocols, keys, certificates and algorithms across your target scope.
03 · Inventory
Get the CBOM
The scan produces a CycloneDX 1.7-aligned Cryptographic Bill of Materials: a structured, machine-readable inventory of the cryptography you actually run, severity-scored and mapped to NIST controls.
Deployment
Three ways to run CipherScout
Choose the deployment that matches your data-residency requirements and the depth of discovery you need. All three models include Bring Your Own Database (BYOD) by default: scan data is written to your own provisioned database, and ExeQuantum never holds or accesses it.
01
Cloud SaaS
Fastest to start. Run discovery and CBOM generation without standing up infrastructure. Ideal for initial assessments, external surface scans and teams evaluating before committing to an on-premises deployment.
02
On-premises
As easy as installing an app: download the signed bundle, verify it, run it. No custom infrastructure, no professional services engagement. Once running, it reaches the assets a cloud scan never could: OT-adjacent networks, internal certificate authorities, database layers and IoT/edge devices.
03
Air-gapped
The on-premises box deployed into a fully disconnected environment. Discovery runs entirely inside the network with no external connectivity. Built for defence, critical infrastructure and highly regulated estates where data must never traverse an external boundary.
BYOD across every model
Bring Your Own Database is the default, not an upgrade. In every deployment mode, scan data is written to your own provisioned database. ExeQuantum never holds your keys, findings or estate data. If a specific engagement requires a different arrangement, we accommodate it, but the architecture starts sovereign.
Sovereignty
Discover, plan and watch: inside your boundary
For on-premise and air-gapped estates, we run discovery inside your network and your data stays within your environment.
01
Signed-bundle install
The on-premises bundle is verified with ML-DSA-65 + minisign before it runs, with per-box TLS certificate issuance and auto-provisioned per-box subdomain auth.
02
On-premises discovery
The on-premises box discovers assets and maps topology inside your network, with no cloud round-trip, so internal and air-gapped estates are in scope from day one.
03
Bring your own database (BYOD)
Per-tenant database isolation, central egress guards on scanner sockets and target-bound, server-whitelisted scans keep your keys and findings within your environment.
Sovereign by deployment and isolation
EQCore is sovereign and data-residency-preserving: it runs on your infrastructure and keeps your keys and data within your boundary. This is a deployment and isolation guarantee, described precisely.
Output
One scan. One inventory.
CipherScout produces a CycloneDX 1.7-aligned CBOM: a machine-readable inventory of every protocol, key, certificate and algorithm found across your estate, severity-scored and mapped to the controls your auditors care about.
Inventory
Cryptographic Bill of Materials (CBOM)
A CycloneDX 1.7-aligned CBOM: structured, machine-readable and portable. The inventory you keep whether or not you go further.
Risk
Severity-scored findings
Each finding is severity-scored for quantum risk (critical, high, medium or low) so you can see where deprecated and quantum-vulnerable cryptography concentrates.
Controls
NIST control references
Every finding carries a NIST control reference, so the summary you hand to auditors and boards lines up with the governance frameworks your teams already work to.
Compliance
Frameworks you already report against
EQCore maps findings to the governance frameworks you report against, so cryptographic gaps land as control references your auditors recognise.
Framework mapping
These are the frameworks EQCore maps findings to: a product capability, distinct from certifications ExeQuantum holds. ExeQuantum’s own certifications (ISO 27001, AUKUS Authorised User) are listed separately on the Trust Centre.
If a framework you report against isn’t covered yet, we can add it quickly.
Marketplace
Fits the tools you already run
The EQCore marketplace plugs into the infrastructure you already run: cloud key stores, identity, certificate tooling, SIEM and ITSM. Discovery, remediation and alerting flow straight into your existing estate.
Cloud KMS
Cloud key & certificate stores
Authenticated discovery against AWS KMS, Azure Key Vault and GCP KMS, so the keys and certificates managed in your cloud are part of the inventory.
SIEM
Findings to your SIEM
On scan completion, findings export to your SIEM, auto-detecting Splunk HEC, QRadar or a generic HMAC-signed HTTPS webhook from the configured URL.
ITSM & collaboration
Tickets and alerts where you work
ServiceNow incident creation turns a finding into a tracked ticket. Slack notifications push alerts to the channel your responders watch, so nothing waits in a dashboard.
Architecture
Where the cryptography actually runs
EQCore is the control plane: it discovers, scores and orchestrates your post-quantum migration. The post-quantum algorithm operations run in a dedicated service add-on.
How the crypto runs
EQCore plans and orchestrates the migration; the PQC service performs the operations. Crypto-agility means swapping algorithms through the registry, so your applications stay untouched.
See what you actually run
A trial runs CipherScout against a scope you define, inside your boundary, and hands back a CBOM, a crypto-posture view and a sample prioritised remediation plan.