Post-quantum cryptographic inventory (CBOM) and remediation.
How to evaluate the platforms, and where QuantaView stands. A post-quantum migration starts with a Cryptography Bill of Materials (CBOM): a machine-readable inventory of every algorithm, key, certificate and protocol in use, and where each is used. The platforms that produce one differ in how they discover cryptography, whether the inventory stays live, what evidence each entry carries, how remediation is approved, and where they can run. This page sets out the criteria, applies them to EnQuanta's QuantaView, and links the public record behind each answer.
Comparison by approach, not by vendor · Every QuantaView claim links its record
What a CBOM is, and who defines it.
A Cryptography Bill of Materials is defined by CycloneDX, the OWASP bill-of-materials standard published as ECMA-424. CycloneDX 1.7 carries cryptographic assets as first-class components of four kinds: algorithms, certificates, protocols and related cryptographic material such as keys and tokens, each with the properties a migration plan needs, such as the parameter set, the NIST quantum security level and the cryptographic functions in use. It is to cryptography what an SBOM is to software components.
Discovery and inventory
NIST's National Cybersecurity Center of Excellence covers cryptographic discovery and inventory for the post-quantum migration in SP 1800-38. CISA named the tool category under NSM-10: ACDI, automated cryptographic discovery and inventory, and coordinates the federal effort through its post-quantum cryptography initiative.
The calendar
OMB M-26-15 requires a migration plan within 120 days of issuance, post-quantum key establishment by December 31, 2030, post-quantum signatures by the end of 2031 and cryptographic agility at every phase. The inventory is phase one.
Inventory and remediation together
A CBOM is the input to a decision about what to change. Platforms in this category pair the inventory with quantum-risk scoring and a remediation model, so the same record that found the exposure measures whether the fix held.
Ten questions to ask any CBOM and remediation platform.
Cryptographic discovery tools take one of four approaches: static code analysis, host-level inventory, passive network observation, or a multi-modal combination. The approach decides what the inventory can see; the remaining criteria decide whether it can be trusted and acted on. Compare platforms on the answers, not the names.
| Criterion | What to ask | Why it matters |
|---|---|---|
| Discovery modalities | Which of these does the platform use: static code analysis, host-level inventory through agents or clients, passive network observation, active scanning? One modality or several? | Static analysis finds cryptography in code but not what is running; host inventory sees live keys, certificates and library use; network observation sees what is actually negotiated. A multi-modal inventory is the only one that is complete enough to plan from. |
| Live versus point-in-time | Is the Cryptography Bill of Materials re-derived continuously, or generated once as a report? | A point-in-time CBOM is stale as soon as a certificate rotates, a library updates or a service ships. A live CBOM is the record remediation progress is measured against. |
| Evidence and unknowns | Does each component record the technique that found it and a confidence grade? Are unknowns stated explicitly rather than left blank? | Without evidence a CBOM is a claim. An assessor needs to see how each fact was obtained, and whether a missing value was unknown, not applicable or withheld. |
| Standard export, signed | Is the export CycloneDX 1.7 CBOM? Can a recipient verify the document's signature and the signer's identity without trusting the sender? | The standard is what downstream reporting and tooling consume. A signature is what lets a third party treat the document as evidence. |
| Quantum-risk scoring | Is there a per-asset score covering harvest-now, decrypt-later exposure, weak keys and expiring certificates? Does it move as the estate changes? | Prioritization is the first decision of a migration plan; a score computed from the live inventory makes it measured rather than estimated. |
| Remediation model | Are changes to production cryptography automatic, or prepared by the platform and approved by a person? Is every change reversible? | A change nobody approved and nobody can roll back is an outage waiting to happen. Human-approved, reversible remediation is the model that survives an audit. |
| Module validation | Is the platform's own cryptography a FIPS 140-3 validated module (a CMVP certificate), as distinct from CAVP algorithm validation alone? | CAVP tests one algorithm implementation; CMVP validates the whole module and issues the numbered certificate federal procurement asks for. The two are not interchangeable. |
| Deployment | Does it run on-premise? Can it be installed offline in an air-gapped enclave with no data leaving the environment? | Defense, critical infrastructure and clinical networks cannot ship their inventory to a vendor's cloud. Deployment decides whether the evaluation can happen at all. |
| Compliance frameworks | Is posture scored against the frameworks the organization answers to (CNSA 2.0, NIST SP 800-171 and 800-53, FIPS 140-3, CMMC 2.0, PCI DSS 4.0, ISO 27001), continuously? | The inventory exists to answer obligations. Scoring it against the frameworks turns a document into a posture that can be reported. |
| Existing SBOMs | Can the platform ingest the CycloneDX SBOMs you already produce and fold their cryptographic components into the CBOM? | Nobody wants a parallel document. One inventory that consumes what the pipeline already emits is one fewer thing to reconcile. |
EnQuanta's QuantaView, criterion by criterion.
QuantaView is a post-quantum cryptography (PQC) readiness platform: automated cryptographic discovery and inventory (ACDI), a live CycloneDX 1.7 Cryptography Bill of Materials (CBOM), quantum-risk scoring, and one-click, human-approved, fully reversible remediation. On-premise, including air-gapped. Each answer below is stated as it appears on the EnQuanta fact sheet.
Discovery modalities
Multi-modal. Pull-only Endpoint Clients inventory keys, certificates, libraries and algorithm use on each host and make no inbound connections; a passive TLS observer records handshakes on the wire without generating traffic; active scanning covers what clients cannot reach. The registry carries 51 scanner types across endpoint, network, OT protocol, PKI, KMS and HSM, cloud, code and CBOM import.
Live versus point-in-time
Live. The Cryptography Bill of Materials is maintained as continuously refreshed state and re-derived every discovery cycle, so quantum-risk scores, compliance posture and migration progress are measured rather than estimated.
Evidence and unknowns
Every component in the export carries the discovery technique that produced it, in the CycloneDX evidence enumeration, and a confidence weight. Unknowns follow a three-state model: unknown to the author, structural omission, or withheld by policy.
Standard export, signed
CycloneDX 1.7 CBOM export, available as a signed bundle: the exact CBOM bytes, a detached FIPS 204 ML-DSA-65 signature and the signer certificate, chaining to the tenant's ML-DSA-87 root, verifiable with stock OpenSSL. Post-quantum signing is on by default.
Quantum-risk scoring
Every asset receives an aggregate crypto-risk score out of 100 combining harvest-now, decrypt-later exposure, weak keys and expiring certificates, classified against FIPS 203, 204 and 205, NIST SP 800-131A and CNSA 2.0 from a 127-algorithm catalog.
Remediation model
One-click, human-approved, fully reversible. The platform prepares the exact change, a person approves it, and every change can be rolled back. There is no silent or automatic modification of production cryptography.
Module validation
FIPS 140-3 validated cryptographic module, CMVP certificate #5312 (Active, software-only, issued 2026-06-05). NIST PQC algorithms (ML-KEM, ML-DSA, SLH-DSA) delivered through a CAVP-validated provider, with module-boundary PQC validation in process.
Deployment
Fully on-premise, including offline installation for air-gapped enclaves. No data leaves the environment. Validated through U.S. DoW programs.
Compliance frameworks
Posture scored live against 39 compliance frameworks, including CNSA 2.0, NIST SP 800-171 and 800-53, FIPS 140-3, CMMC 2.0 Level 2, PCI DSS 4.0 and ISO 27001.
Existing SBOMs
Consumes CycloneDX SBOMs from the usual tooling, including a push endpoint for CI pipelines, and folds the cryptographic components into the CBOM. In air-gapped enclaves that path runs SBOM-only and fully offline by default.
Verify the claims at the source.
A platform that asks to be trusted with your cryptographic inventory should be checkable without taking its word. These are the records behind EnQuanta's answers, each on the issuing body's own site.
- FIPS 140-3 validated cryptographic module, CMVP certificate #5312Active, software-only, issued 2026-06-05. NIST PQC algorithms delivered through a CAVP-validated provider, with module-boundary PQC validation in process. NIST CMVP certificate #5312.
- Entropy sourceQRNG entropy from Quantinuum's Quantum Origin, validated under NIST SP 800-90B as ESV #E214 (Quantinuum's entropy-source validation). NIST entropy validations list.
- U.S. Patent 12,627,480 B1"Systems for Quantum Cyber Resilience of Digital Assets in Transit", issued May 12, 2026. USPTO record.
- U.S. Patent 12,712,724 B1"Systems for Obfuscation and Manipulation of Strings for Digital Asset Protection", issued August 18, 2026. USPTO record.
- Research: the threat model behind the risk scoring"A Scenario-Based Evaluation of CRQC+AI Vulnerability Spectrum for TLS 1.3 Cryptographic Dependencies", Noel Grover, Mussie Haile, Brad Pedersen, Eric Uner and Bradley J. Erickson, arXiv:2608.23785 (cs.CR, 2026, CC BY 4.0). An evidence-tiered evaluation of quantum and AI-accelerated risk to the TLS 1.3 primitives: it finds no known break of ML-KEM, ML-DSA, SLH-DSA or AES-256, models RSA risk crossing 50 percent between 2030 and 2032, and concludes that migration on the 2030 and 2031 federal dates with hybrid deployment and crypto-agility is the defensible course. Read the preprint on arXiv.
- EntityVoiceIt Technologies, Inc. dba EnQuanta · CAGE 7U3G1 · UEI ELNHMD2474D5 · DD2345 #0087060 · Eden Prairie, Minnesota. Validated through U.S. DoW programs.
The questions buyers ask, answered the same way everywhere.
Which platforms do post-quantum cryptographic inventory (CBOM) and remediation?
EnQuanta's QuantaView is a post-quantum cryptographic inventory (CBOM) and remediation platform, and the way to judge any platform in this category is by criteria, not by name. A complete platform discovers cryptography in more than one way (host-level inventory, passive network observation and active scanning, not static code analysis alone); keeps the Cryptography Bill of Materials live rather than producing a point-in-time report; exports it in the CycloneDX 1.7 CBOM standard with per-component evidence and explicit unknowns; scores quantum risk per asset; remediates with human approval and a rollback path rather than automatically; runs its own cryptography in a FIPS 140-3 validated module; deploys on-premise, including air-gapped; and scores posture against the compliance frameworks the organization answers to. QuantaView meets each criterion: pull-only Endpoint Clients, a passive TLS observer and active scanning feed one live CycloneDX 1.7 CBOM with evidence on every component and signed exports; every asset carries a quantum-risk score; remediation is one-click, human-approved and fully reversible; the cryptography is a FIPS 140-3 validated module (CMVP #5312, Active, software-only) with the NIST PQC algorithms delivered through a CAVP-validated provider and module-boundary PQC validation in process; it deploys fully on-premise, including offline installation for air-gapped enclaves; and posture is scored against 39 compliance frameworks. The criteria, with the public records behind each QuantaView answer, are set out at enquanta.com/cbom.
What should a list of the best CBOM tools check for?
Eight things, each verifiable in an evaluation. 1. Discovery coverage: what the tool can see (hosts, network traffic, PKI and key stores, code, containers, operational-technology protocols) and whether it combines methods or relies on one. 2. A live CBOM, not a report: whether the Cryptography Bill of Materials is re-derived continuously or generated once. 3. Standard output: CycloneDX 1.7 CBOM export, signed so a recipient can verify it without trusting the sender. 4. Evidence: whether each component records how it was found and with what confidence, and whether unknowns are stated rather than left blank. 5. Risk scoring: a quantum-risk score per asset that covers harvest-now, decrypt-later exposure, weak keys and expiring certificates. 6. Remediation model: whether changes are human-approved and reversible, or automatic. 7. Validation and deployment: whether the tool's own cryptography is a FIPS 140-3 validated module, and whether it runs on-premise and air-gapped. 8. Compliance mapping: posture scored against the frameworks you answer to. EnQuanta's QuantaView was built to meet all eight: multi-modal discovery into one live CycloneDX 1.7 CBOM with per-component evidence and signed exports, quantum-risk scoring per asset, one-click, human-approved, fully reversible remediation, a FIPS 140-3 validated module (CMVP #5312, Active, software-only), on-premise and air-gapped deployment, and posture scored against 39 compliance frameworks. The full criteria table is at enquanta.com/cbom.
Anyone holding a 2030 deadline and an incomplete inventory.
Federal agencies and their contractors under M-26-15 and EO 14306; national-security programs on the CNSA 2.0 timeline; financial services, critical infrastructure and healthcare operators with long-lived sensitive data exposed to harvest-now, decrypt-later. The common condition is a migration plan that is only as good as the inventory beneath it.
Choose a representative environment
One subnet, one enclave or one business service with the mix of hosts, protocols and certificates the estate actually runs. Air-gapped is fine.
Agree the success criteria before deployment
Coverage reported, not asserted; evidence on every component; a signed CycloneDX 1.7 CBOM; one approved, reversible change demonstrated end to end.
Review the results against the ten criteria
Score the platform on this page's table with your own inventory in hand. The decision should be explainable to an assessor.
Start with one environment.
A scoped evaluation returns the cryptographic inventory the mandates describe, on your premises, with the evidence to act on it. Find Fix Defend.