PQCAT scans your infrastructure for quantum-vulnerable cryptography, scores your compliance against CNSA 2.0, NIST SP 800-131A, and 11 regulatory frameworks — then proves it with evidence your auditors will accept.
curl -sSL https://install.pqcat.io | sh
irm https://install.pqcat.io/windows | iex
Every scan produces a normalized 0–100 compliance score, CBOM inventory, and actionable remediation plan.
Deep protocol analysis across TLS, SSH, and DNS endpoints. Full cipher suite enumeration, certificate chain validation, and quantum-risk classification — covering every exposed service in your network.
SSL Labs-grade assessment: cipher enumeration, protocol probing (TLS 1.0–1.3), certificate chain analysis, ML-KEM detection, DNSSEC/DANE validation — 90× faster.
Inventories authorized_keys, server host keys, and key exchange algorithms. Flags DSA, RSA-1024, and ECDSA keys for rotation.
Scans entire subnets. Discovers SSH, TLS, IPsec, and DNS endpoints. Maps every cryptographic asset on your network perimeter.
Static analysis across 40+ languages, dependency scanning against 183 known-vulnerable libraries, and container image inspection — catching quantum-vulnerable patterns from source to deployment.
Regex + AST scanning across 40+ languages. Finds hardcoded keys, weak algorithms, and deprecated crypto patterns in your repos.
Parses CycloneDX and SPDX BOMs. Cross-references 183 library signatures against known quantum-vulnerable dependencies.
Scans Docker and OCI container images for embedded cryptographic libraries, certificates, and key material with quantum-vulnerability classification.
Analyze server configurations, certificate stores, Java keystores, and SCAP benchmark results — ensuring every infrastructure component aligns with quantum-readiness requirements.
Scans nginx, Apache, OpenSSL, and SSH configuration files for weak cipher selections, deprecated protocols, and non-compliant crypto settings.
Crawls certificate stores, Java keystores, and PEM directories. Full chain validation with quantum-risk classification per asset.
Ingests SCAP/XCCDF benchmark results and cross-references crypto policy findings against quantum readiness requirements.
Discover and classify every cryptographic asset across AWS cloud services — then quantify the risk of "harvest now, decrypt later" attacks with the patent-pending HNDL Risk Engine.
AWS KMS, ACM, ELB, S3, Route 53, and IAM scanning. Auto-detect credentials via IAM roles. Zero write permissions required.
Patent-pending per-asset exposure scoring. Calculates "harvest now, decrypt later" risk based on data sensitivity, retention period, and regulatory quantum timeline.
Every scan maps findings to your regulatory obligations. One command, one score, one report your auditor signs off on.
Single static binaries. No Docker, no Java, no Python runtime, no shared libraries. Copy it, run it.