PQCAT inventories every key, certificate, cipher, and dependency across your estate, scores it against CNSA 2.0, NIST SP 800-131A, and 11 regulatory frameworks, then hands your engineers the exact fix for each finding.
Built by the team behind the Halborn-audited Soqucoin post-quantum L1. Eight patents pending.
The Pro Command Deck is built for one thing: get a security team from a target to a decision fast. No agents, no console training, no three-week onboarding.
Open the deck and type a target. PQCAT auto-detects what to scan across TLS, SSH, source, SBOMs, and container images. There is nothing to configure first.
The scan streams live, then resolves to a readiness score, the quantum-vulnerable / transitional / safe breakdown, and the full asset inventory. This is GitHub, assessed against CNSA 2.0 in about four seconds.
Every finding rolls up into a remediation playbook: the problem in plain terms, the target algorithm, and the copy-paste config for your platform, with the standards citation next to it. Other scanners hand a CISO a dashboard of red. PQCAT hands their engineer the patch.
The evidence suite mints a portable Challenge Coin from any assessment. Hand it to an auditor and they re-derive the exact verdict offline, on their own machine, with no PQCAT and no trust in you. It fails closed the moment a byte is altered, and the score is recomputed from the findings rather than read back, so a coin whose grade does not follow from its own evidence is refused even when the seal is valid and the signer is trusted. The same tab carves firmware for the hardware-rooted Quantum X-Ray verdict. No other scanner ships proof you can re-check yourself.
Eleven scanner modules cover the estate. Five evidence instruments prove what they find. Every scan produces a normalized 0–100 compliance score, a cryptographic bill of materials (CBOM), and a remediation plan that names the fix.
Deep TLS assessment, SSH key audit, and CIDR discovery across the perimeter.
Source analysis in 40+ languages, SBOM scanning against 183 quantum-vulnerable library signatures, and container-image inspection.
Configuration analysis, PKI and X.509 estate inventory, SCAP compliance, and firmware carving that pulls certificates and keys straight out of UEFI capsules and flash dumps.
AWS KMS, ACM, ELB, S3, Route 53, and IAM, with the patent-pending HNDL Risk Engine scoring each asset's harvest-now-decrypt-later exposure.
The finding is only half the job. pqcat remediate prove binds the before-state and after-state of the same asset under one post-quantum signature, and the finding closes only if verification passes.
Prove your post-quantum posture while revealing only the part you choose. pqcat disclose commits the inventory under one root and opens exactly one asset class; everything else stays sealed.
The most durable quantum-vulnerable cryptography lives below the operating system. pqcat xray binds a verdict to the exact excavated firmware bytes; a verifier re-dumps the region and the verdict re-derives from the hardware itself.
Harvest-now-decrypt-later stops being a slogan. pqcat harvest puts a number on how many asset-years of your traffic an adversary can already have collected, and flags what is effectively already disclosed.
Hand an auditor one file. pqcat coin mints portable evidence they re-verify offline, on their own machine, and it fails closed the moment anything is altered. pqcat kiosk renders it as a placard for a booth screen or a secure facility. Or skip the install entirely: verify a coin in your browser, right now. Same math as the CLI, nothing uploaded.
Eleven frameworks. One normalized score.
PQCAT maps every finding to the frameworks regulators and auditors actually use, and rolls them into a single 0–100 readiness score, with the evidence to back it.
Four of the nine things federal reporting asks for cannot be scanned. They do not exist in your infrastructure.
Federal cryptographic reporting asks for nine data items per system. Only some of them describe cryptography. The others describe the system’s identity: its FISMA system number, its FIPS 199 impact level, whether a program office designated it a High Value Asset, and where it is hosted.
No scanner can find those, at any quality. A certificate does not know the impact level of the system it protects. A config file does not know whether anyone called this an HVA. CISA’s own guidance says most of the nine are collected by hand, and GSA states plainly that no known tool captures all nine.
So PQCAT stops trying to scan them and reads them from your system of record instead. It ingests an eMASS, CSAM, Xacta or CSV export, your HVA list, and your records schedule, and binds every discovered cryptographic asset to the system that owns it.
The part that matters is not the nine. It is that every cell records how it got its value.
Each value is marked discovered by a scanner, imported from a named export with that file’s digest recorded, or asserted by a named person on a date under a stated authority. Anyone can hand you a nine-column spreadsheet by typing the missing six columns. That spreadsheet is an opinion formatted as a table, and nothing in it tells you which cells a person invented.
The provenance is sealed inside the same commitment as the values, under one ML-DSA-44 signature covering both the inventory and the reporting table. Change an impact level after the fact and it fails closed. Relabel a cell from imported to something you asserted yourself and that fails closed too, because how each cell was established is committed alongside what it says.
Coverage is recomputed from the sealed table, never claimed. A partial registry reports partial, and assets that matched no system are reported as unbound rather than dropped, because a tool that drops them reports better coverage than it achieved.
Built on that binding: a reconciliation against your last submission that separates newly discovered assets from newly deployed ones with per-asset evidence, so a higher count reads as a better inventory rather than a worse posture; a shared-responsibility proposal splitting your boundary between you and your cloud provider; a published Cryptographic Agility Index for a mandate that defines no metric; and a draft migration plan covering all nine required plan sections. In the CLI, in the air-gapped Enclave build, and in the Pro and Cloud dashboards.
Prove compliance without revealing your infrastructure. The Confidential Compliance Engine (patent-pending) lets you run pqcat scan --confidential and produce a report that demonstrates readiness without exposing a single hostname.
Six of the eight capabilities we previewed here now ship in v2.9 and live under Capabilities above. Two remain ahead: names and intent only, the engineering follows.
A durable, tamper-evident record of your compliance posture as it changes, so the story holds up long after any single scan.
A shared, cross-organization picture of quantum exposure across a mission, without any party surrendering its own inventory.
Where this stands. The evidence suite ships today: portable Challenge Coins, the Harvest Clock, firmware carving, and the hardware-rooted Quantum X-Ray verdict all run in the current release, in the CLI and the Pro dashboard, and any Challenge Coin can be re-verified in a browser with nothing installed. A few capabilities on this page are still in active development. Talk to Soqucoin Labs about early access for a federal or enterprise program.
Three editions, one engine. Single static binaries. No Docker, no Java, no Python runtime, no shared libraries. Copy it, run it.
Most air-gap claims are a sentence on a web page. Ours is a property of the binary, and you can confirm it in one command without installing anything of ours: go tool nm pqcat | grep 'http.(*Server)' returns nothing on the Enclave build. Nothing listens. There is no HTTP server, no REST API and no dashboard to switch off, because the code for them is not in the binary at all, compiled out behind a build tag. A hosted product cannot make that claim retroactively, and a policy setting is not the same kind of statement.
go tool nm pqcat | grep 'http.(*Server)'Enclave is free and open source. Download it from GitHub or install it with the one-liner above. Pro and Cloud are not sold self-serve; they are delivered and supported directly for federal and enterprise programs. Talk to Soqucoin Labs about a pilot.
Try the live TLS server test in your browser, or install the scanner and run a full assessment against your own estate. Enclave is free and open source.