Crypto Asset Discovery Platform

You cannot migrate what you cannot see.

Finds every use of cryptography across your estate, on the wire, on disk, in source and in container images, scores it for post-quantum risk and exports a CycloneDX inventory your auditor can read.

• Network and host sensors, plus agentless scans
• Editable, audited classification policy with dry-run
• Per-system CycloneDX 1.7 CBOM and OPA compliance
• Nothing discovered leaves your environment

Quantum Safe Risk Assessment Platform

An inventory is not a plan.

The governance tier above CADP. Consolidates every estate you run, adds the business context discovery cannot see, scores quantum risk quantitatively and turns the result into a migration plan with owners and dates.

• Multi-estate consolidation with provenance intact
• Owner, criticality and data-sensitivity enrichment
• Quantitative risk scoring on Mosca's inequality
• Compliance mapping and migration tracking

Cybersecurity Strategy and Maturity Platform

A strategy you can re-run is worth more than one you can print.

Current-state assessment, target-state definition and rapid maturity analysis kept as live artefacts, so the roadmap on the board pack in March is still the roadmap in September.

• Evidence-backed current-state assessment
• Rapid maturity analysis against the frameworks you are held to
• Roadmaps sequenced by effort, dependency and deadline
• Board reporting on progress, not a fresh list of findings

Crypto Network Sensor

Configuration says what should happen. The wire says what did.

A passive Rust sensor that parses TLS, SSH, IKE/IPsec, DTLS and QUIC handshakes on any port and reports the cryptography actually negotiated — including whether post-quantum was offered and then quietly dropped.

• Port-agnostic, content-based protocol detection
• ML-KEM aware, with offered-versus-negotiated on every flow
• Opt-in certificate recovery for TLS 1.3, QUIC and DTLS
• 1 Gbps design target, Linux, Windows, FreeBSD and Solaris

Mosaic Host Sensor

The keys that never talk are still keys.

At-rest discovery on the host itself: certificates, private keys, keystores, SSH keys, configuration and every container image actually deployed — including the systems that stay silent all quarter.

• Linux, Windows, FreeBSD, Solaris and AIX
• Container images scanned in place, no registry pull
• ML-DSA and ML-KEM material detected by OID
• Reports host identity, which is what fuses on-wire with on-disk

Post-Quantum Remediation and Migration Kit

Knowing what to migrate is the easy half.

A sandbox with its own ML-DSA certificate authority and sixteen migration templates, where a hybrid or post-quantum change is proved against a captured handshake before it goes near production.

• Standalone ML-DSA PKI — public CAs will not issue what you need to test
• Sixteen templates: edge TLS, SSH, IPsec, MQTT, key wrapping, code signing
• Assertions run against the packet capture, not a vendor claim
• A capacity run for what larger keys break, and a middlebox pass