Three deadlines landed within three weeks of each other.
On September 3, the G7 Cybersecurity Working Group published Preparing for the Post-Quantum Era: A Call to Action, co-issued by the cybersecurity agencies of all seven member nations. The recommended starting point for every organisation: inventory your cryptographic assets.
On September 21, NIST moved every remaining FIPS 140-2 certificate to Historical status. Any organisation whose compliance depends on validated cryptographic modules now needs to know exactly which modules it is running and whether those modules hold an active FIPS 140-3 certificate.
On January 1, 2027, all new National Security System acquisitions must support CNSA 2.0 algorithms under the NSA mandate.
And the momentum is not limited to the United States. The EU's NIS Cooperation Group requires member states to have initiated PQC "first steps" by December 31, 2026, with high-risk systems migrated by the end of 2030. Australia's ASD ISM targets a 2030 PQC mandate. India's NQM Task Force has set a 2027 foundation deadline for critical infrastructure sectors. Canada's CCSPA introduces cybersecurity obligations for critical infrastructure operators. The regulatory convergence is global, not just American.
The common thread across all of it is the same question: what cryptography are you actually running?
That question is harder than it sounds. Unlike firewalls or identity systems, cryptography is not centralised. It is scattered across TLS configurations, API endpoints, source code, SSH keys, JWT tokens, cloud key management services, databases, email systems, and embedded devices. Most organisations have no single view of all of it. Many have no view at all.
The industry calls this problem cryptographic discovery, and in 2026 it has become the prerequisite for every PQC migration conversation. You cannot migrate what you have not mapped. You cannot prioritise what you have not scored. And you cannot prove compliance without a Cryptographic Bill of Materials (CBOM) that auditors can actually read.
This article compares seven vendors with genuine cryptographic discovery capabilities. Not general-purpose PQC encryption providers. Not advisory firms. Platforms that can scan your environment and tell you what is there.
Before comparing vendors, it helps to know what separates a thorough discovery tool from a shallow one.
Surface coverage. Cryptography lives in more places than most security teams realise. TLS certificates are the obvious starting point, but they are only one surface. A complete picture includes network traffic, source code and compiled binaries, APIs and HTTP endpoints, SSH configurations, JWT and JWKS identity infrastructure, KMS instances (cloud or HSMs), databases, email (S/MIME, DKIM, etc), file systems, and IoT or OT devices. Most vendors cover two or three of these. Very few cover more than five.
CBOM output. The G7 guidance and the broader regulatory direction both point toward structured, machine-readable cryptographic inventories. CycloneDX is the emerging standard for CBOM formatting (IBM Research originally invented the CBOM concept and contributed it to CycloneDX, where it was formalised in version 1.6). Some vendors produce proprietary reports. Some produce CycloneDX. The difference matters when your auditor, your board, or your regulator asks for evidence.
Deployment model. Some organisations can send data to a SaaS platform. Others, particularly in defence, government, and critical infrastructure, require on-premise or air-gapped deployment. Discovery tools that only work as cloud-hosted SaaS are immediately disqualified from a significant portion of the market.
Discovery-to-remediation path. Finding vulnerable cryptography is necessary but not sufficient. The most useful platforms connect discovery output to remediation workflows, whether that means integrating with JIRA and DevOps pipelines, feeding into a governance dashboard, or directly orchestrating algorithm replacement.
Headquarters: Palo Alto, USA Primary approach: Runtime discovery and AI-powered analysis Key surfaces: Network traffic, applications (runtime), file systems CBOM output: Proprietary inventory format Deployment: Cloud, on-premise Certifications: FedRAMP Ready (Moderate), SOC 2 Type I, ISO 27001
SandboxAQ is the most heavily funded player in this space, with over $950M raised to date at a $5.3B pre-money valuation on its 2025 Series E. AQtive Guard discovers cryptography from runtime behaviour rather than static scans, using network analysis and runtime tracing to reveal what is actively running in production, including dynamically loaded libraries and shadow cryptographic instances that static tools miss.
The platform's strongest credential is its federal footprint. SandboxAQ has a five-year agreement with the Department of War CIO for automated cryptographic discovery across DoW systems, and it participated in DISA's QRC PKI programme. AQtive Guard sits on the FedRAMP Marketplace at the Moderate impact level.
Best for: Large US federal agencies and Fortune 500 enterprises that need AI-powered discovery at massive scale and can pair it with separate remediation tooling.
Worth noting: SandboxAQ's commercial traction outside the US federal market is less well-documented in public sources. The platform is strongest in network and runtime application discovery. Source code scanning and identity-layer discovery (JWT, JWKS) are not prominently featured in its public documentation.
Headquarters: InfoSec Global (Toronto, Canada), acquired by Keyfactor (Independence, Ohio, USA) Primary approach: Host-based, network, and application scanning Key surfaces: Network traffic, host file systems, applications, certificates, keys, cryptographic libraries CBOM output: Structured inventory with compliance scoring Deployment: Cloud, on-premise Integrations: CrowdStrike Falcon, ServiceNow, Microsoft Security, IBM Consulting
Keyfactor's acquisition of InfoSec Global and Quantum Xchange's CipherInsights product created one of the broadest discovery-to-lifecycle platforms on the market. AgileSec Analytics scans hosts, networks, and applications to build a centralised inventory of certificates, keys, and cryptographic mechanisms. The CipherInsights technology adds passive network traffic monitoring for real-time cipher suite visibility.
The CrowdStrike Falcon integration is particularly significant: organisations that already run Falcon can deploy the AgileSec sensor across their existing endpoint footprint without additional infrastructure.
InfoSec Global's team includes co-authors of NIST-standardised PQC digital signature algorithms, and the AgileSec platform is on the DHS Continuous Diagnostics and Mitigation Approved Product List.
Best for: Enterprises that want to connect cryptographic discovery directly into certificate lifecycle management and PKI modernisation, particularly those already using CrowdStrike or ServiceNow.
Worth noting: The Keyfactor acquisition is relatively recent, and the integration of three separate products (AgileSec Analytics, AgileSec Agility, CipherInsights) into a unified experience is still maturing. Keyfactor's heritage is in PKI and certificate management, which means the discovery layer naturally gravitates toward certificates and keys rather than broader cryptographic surfaces like JWT fleets or cloud KMS instances.
Headquarters: Armonk, USA Primary approach: Source code and object code scanning (Explorer), enterprise-wide network and asset analysis (Advisor), centralised cryptographic asset management (Guardium) Key surfaces: Source code, compiled binaries, network assets, certificates, data flows CBOM output: CycloneDX CBOM (IBM Research originally developed the CBOM specification) Deployment: On-premise, hybrid Integrations: IBM z16 mainframes, IBM Cloud, JIRA, GitHub, IDE plugins
IBM's approach splits discovery into three tools. Explorer scans source code and object code to identify cryptographic artifacts, map dependencies, and generate a CBOM. Advisor performs enterprise-wide analysis across network and security scanner output, consolidating CBOMs and metadata to produce a prioritised risk assessment. Guardium Cryptography Manager adds centralised policy enforcement and lifecycle management.
The source code scanning capability is genuinely strong. Explorer generates call graphs that trace cryptographic dependencies through application logic, which is essential for organisations with large custom codebases. The integration with IBM's z16 mainframe ecosystem also makes this the natural choice for banking and insurance organisations running IBM infrastructure.
Best for: Large enterprises with significant custom code, mainframe environments, or existing IBM security investments. Organisations that want source-level cryptographic visibility, not just network-level.
Worth noting: IBM Quantum Safe is an enterprise product suite with enterprise pricing and deployment complexity. The three-tool architecture (Explorer, Advisor, Remediator) means organisations need to commit to the full IBM stack to get the complete discover-observe-transform workflow. Smaller organisations or those without IBM infrastructure may find the overhead disproportionate.
Headquarters: San Mateo, USA Primary approach: Network-level traffic analysis with policy-driven remediation Key surfaces: Network traffic (TLS, data in transit), endpoints CBOM output: CycloneDX CBOM Deployment: Software-only, cloud, on-premise, hybrid, air-gapped Recognition: Gartner Cool Vendor 2026 (Data Security), US Army TRL-7 at Project Convergence Capstone 6, GSA MAS listed, Inc. 5000 (#526)
QuSecure's QuProtect R3 platform takes a distinctive approach: it treats discovery as the starting point for automated remediation, not a standalone exercise. The Reconnaissance module discovers cryptography in use across live network traffic, ranks findings by exposure rather than by count, and feeds directly into the Resilience module, which can renegotiate TLS connections on updated algorithms by policy, without code changes.
The US Army TRL-7 achievement at Project Convergence Capstone 6 is a significant credential, demonstrating operational readiness in live tactical conditions. QuSecure also offers the Reconnaissance module at no cost to qualifying organisations, which lowers the barrier to initial cryptographic inventory.
Best for: Organisations focused on data-in-transit protection that want discovery and remediation in a single platform, particularly US defence and federal environments.
Worth noting: QuProtect's discovery scope is focused on network traffic and endpoint cryptography. It does not scan source code, and its coverage of non-network surfaces (databases, cloud KMS, JWT identity infrastructure) is limited. The platform's strength is its ability to act on what it finds at the network layer, rather than the breadth of what it finds across an entire environment.
Headquarters: Melbourne, Australia Primary approach: Multi-surface scanning with structured CBOM output Key surfaces: TLS/certificates, APIs, HTTP, SSH, JWT fleets (population-level analysis), cloud KMS (AWS, Azure, GCP), source code, email, databases, IoT/OT devices CBOM output: CycloneDX 1.7 Deployment: SaaS, hybrid, on-premise, air-gapped Certifications: ISO 27001, AUKUS Authorised
CipherScout scans across ten distinct discovery surfaces, which is a broader coverage set than most platforms in this comparison. Two capabilities are worth highlighting specifically. First, the JWT discovery module performs fleet-level population analysis rather than point-in-time single-token inspection, connecting to token databases for organisation-wide compliance scoring across the entire JWT estate. Second, it can connect directly to email systems to scan S/MIME certificates and DKIM keys.
CipherScout produces CycloneDX 1.7 CBOM output and feeds directly into ExeQuantum's CipherWatch (continuous monitoring) and CipherForge (PQC implementation) platforms, creating an integrated discovery-to-migration workflow. CipherScout's regulatory alignment spans ASD ISM (Australia), CNSA 2.0 (US), NCSC (UK), and NIS2 (EU), with active deployments and partnerships across North America, Europe, the Middle East, and Southeast Asia.
Best for: Regulated enterprises and government agencies that need broad surface coverage across heterogeneous environments, particularly those operating across multiple regulatory jurisdictions simultaneously.
Worth noting: Organisations that require established US federal procurement vehicles (GSA Schedule, FedRAMP) should factor in that these are not yet in place, though the AUKUS authorisation enables technology transfer across Australia, the UK, and the US.
Headquarters: Tel Aviv, Israel Primary approach: Continuous cryptographic posture management with business-context mapping Key surfaces: On-premises, cloud, and hybrid cryptographic assets; cipher configurations; certificates; data in transit and at rest CBOM output: Not publicly documented Deployment: Cloud, hybrid Funding: $17M seed (July 2026), led by Bessemer Venture Partners and Merlin Ventures
QIZ Security is the newest entrant on this list but arrives with serious backing and pedigree. The company raised $17M in seed funding in July 2026, co-led by Bessemer Venture Partners and Merlin Ventures, with participation from Evolution Equity Partners, Qbeat Ventures, Singtel Innov8, and Qino Cyber Capital. Co-founder and Chief Strategy Officer Dr. Itan Barmes previously directed Deloitte's Global Quantum Cyber Readiness Team, where he supervised PQC migration paths for international banks, telecom operators, and healthcare organisations.
The platform's differentiator is its emphasis on business-context mapping. Rather than producing a flat inventory of cryptographic assets, QIZ maps operational dependencies to specific business software, then ranks vulnerabilities by institutional impact severity to generate automated remediation roadmaps. The company has also partnered with SafeLogic for FIPS-validated cryptographic remediation, connecting discovery output to certified replacement modules.
Best for: Regulated enterprises, particularly in financial services and telecommunications, that need cryptographic discovery tied directly to business-impact prioritisation and automated remediation planning.
Worth noting: QIZ was founded in 2025 and the platform is still early-stage. Public documentation on specific discovery surfaces, CBOM output format, and deployment flexibility (air-gapped, on-premise) is limited compared to more established platforms. The Deloitte advisory heritage and Bessemer backing signal strong execution potential, but production track record is still being established.
Headquarters: Bengaluru, India Primary approach: Full-stack quantum security (discovery, assessment, and assurance) Key surfaces: IT/OT networks, certificates, algorithms CBOM output: CBOM discovery and gap analysis Deployment: On-premise, sovereign Recognition: Incubated at IIT Madras Research Park, supported under India's National Quantum Mission
QShield 2.0 launched on September 21, 2026 as the execution engine for India's National Cryptographic Assessment and Assurance Framework (NCAAF). The platform is structured around three continuous processes: Discover (mapping cryptographic assets), Assess (scoring against quantum vulnerability windows), and Assure (continuous posture validation). Five modules support the framework: Quantum Entropy, Quantum Readiness Risk Assessment, Quantum PKI, Quantum Vault, and AI Security.
QNu Labs' broader portfolio includes quantum key distribution (QKD) and quantum random number generation (QRNG) hardware, which makes QShield 2.0 part of a vertically integrated stack from discovery through to quantum-native key management. Initial deployments are reported at major Indian commercial banks and national security depositories.
Best for: Indian enterprises and government bodies preparing for the NQM Task Force 2027 mandate, particularly those in banking, defence, and critical infrastructure that need sovereign, on-premise deployment.
Worth noting: QShield 2.0 is new (launched September 2026) and its discovery capabilities are not yet documented in the same depth as more established platforms. The NCAAF framework is India-specific, and the platform's relevance to organisations outside the Indian regulatory context is less clear.
| Discovery Surface | SandboxAQ | Keyfactor | IBM | QuSecure | ExeQuantum | QIZ Security | QNu Labs |
|---|---|---|---|---|---|---|---|
| TLS / Certificates | Yes | Yes | Yes | Yes | Yes | Yes | Yes |
| Network traffic | Yes | Yes | Yes | Yes | Yes | Yes | Yes |
| Source code / binaries | Yes | Yes | Yes | No | Yes | Not publicly documented | Not publicly documented |
| APIs / HTTP | Yes | Yes | Yes | Yes | Yes | Not publicly documented | Not publicly documented |
| SSH | Yes | Yes | Yes | Yes | Yes | Not publicly documented | Not publicly documented |
| JWT / Identity | Not publicly documented | Not publicly documented | Not publicly documented | Not publicly documented | Yes | Not publicly documented | Not publicly documented |
| KMS (Cloud/HSM) | Not publicly documented | Yes | Yes | Not publicly documented | Yes | Not publicly documented | Not publicly documented |
| Databases | Not publicly documented | Not publicly documented | Not publicly documented | Not publicly documented | Yes | Not publicly documented | Not publicly documented |
| Email (S/MIME, DKIM) | Not publicly documented | Not publicly documented | Not publicly documented | Not publicly documented | Yes | Not publicly documented | Not publicly documented |
| IoT / OT | Not publicly documented | Not publicly documented | Not publicly documented | Yes | Yes | Not publicly documented | Yes |
| CycloneDX CBOM | Not publicly documented | Not publicly documented | Yes | Yes | Yes | Not publicly documented | Not publicly documented |
| Air-gapped deployment | Not publicly documented | Not publicly documented | Yes | Yes | Yes | Not publicly documented | Yes |
"Not publicly documented" means the capability is not prominently described in the vendor's public-facing documentation as of September 2026. It does not necessarily mean the capability is absent. Vendors may offer additional surfaces or output formats not reflected here.
If you are a CISO reading this in Q4 2026, the practical question is not which vendor is "best." It is which vendor covers the surfaces where your highest-risk cryptography lives.
If your priority is data in transit across a US federal network, QuSecure's network-level discovery and remediation is purpose-built for that. If you need to scan a large custom Java codebase for hardcoded cryptographic calls, IBM Explorer is the strongest option. If you want the broadest surface coverage across a heterogeneous environment with cloud, on-premise, and legacy components, ExeQuantum's ten-surface approach fills gaps that network-only and code-only tools leave open. If you need cryptographic discovery tied directly to business-impact scoring and automated remediation planning, QIZ Security's posture management approach is designed for that workflow. If you need to satisfy India's NCAAF requirements, QNu Labs is the sovereign choice. If you already run CrowdStrike Falcon and want to add cryptographic visibility to your existing endpoint deployment, Keyfactor's integration path is the least-friction option. And if you are a large US federal agency with budget for an enterprise-grade AI-powered platform, SandboxAQ has the federal credentials and the scale.
Geography matters too. Vendors with deep US federal procurement vehicles (FedRAMP, GSA MAS) are the path of least resistance for American agencies but carry limited relevance in other regulatory contexts. Organisations operating under the ASD ISM, APRA CPS 234, the EU's NIS2, or AUKUS frameworks should evaluate whether a vendor's compliance alignment matches their own. ExeQuantum's AUKUS authorisation and ISO 27001 certification map directly to Australian, UK, and trilateral requirements. QNu Labs aligns with India's NCAAF. QIZ's Deloitte advisory heritage spans multiple European and Middle Eastern jurisdictions. The G7 call to action was signed by seven nations, not one.
Start with what the G7 recommended: know what you are running. Everything else follows from that.
ExeQuantum is an ISO 27001 certified, AUKUS authorised post-quantum cryptography company. CipherScout is available for evaluation at exequantum.com/cryptographic-discovery.