Find every quantum-vulnerable connection.
Continuously monitor the cryptography your network actually uses and export it as a CycloneDX CBOM. See which connections are exposed to quantum attack, and which side needs to change.
Your PQC inventory, always current.
Each observer reports as it sees traffic, so the inventory, its risk ratings and the CBOM stay current without rescanning.
The PQC inventory: the share of service pairs that are quantum-safe, the critical risks, the mix of risk across 31 service pairs, the servers refusing post-quantum key exchange, and services becoming quantum-safe as they change.
Every connection, by quantum risk.
Each finding also shows which side must change, the server or the client.
- Critical riskExposed nowSent in the clear, TLS 1.1 or older, RSA key transport or a SHA-1 SSH key exchange. No quantum computer needed.
10.20.0.40:443 · TLS 1.0 · RSA key transport - High riskHarvest now, decrypt laterAny other classical key exchange, such as ECDHE or X25519: safe today, readable once a quantum computer exists.
10.20.0.12:5432 · TLS 1.3 · x25519 - Medium riskPost-quantum, but not NIST-standardsntrup761 and the Kyber drafts: post-quantum, but not the FIPS 203 standard.
10.20.0.50:22 · SSH 2 · sntrup761x25519-sha512 - ML-KEM, alone or hybridKey exchange with ML-KEM, the NIST FIPS 203 standard, on its own or beside a classical group.
1.1.1.1:853 · TLS 1.3 · X25519MLKEM768
Observe, inventory, monitor.
- ObserveRun conflux observe on any host. It reads a copy of each handshake, so it never touches live traffic and needs no enrolment.
- Inventory and CBOMconflux inventory lists every service it has seen, and -cbom writes it as a CycloneDX 1.6 cryptography bill of materials.
- Monitor continuously--export streams every record to the guardian or your own collector over OTLP, keeping the inventory current.
Ready to see your cryptography clearly?
Talk to us about running the observer on your network. Once you know where the gaps are, Protect closes them.