Cryptographic inventory & post-quantum readiness
You can’t migrate the cryptography you can’t see.
Post Quantum Leap finds every certificate, protocol and cipher in your infrastructure, grades them against your policy, and shows you how far you are from post-quantum. Built for the security, PKI and compliance teams responsible for getting there.
- Managed · your cloud · on-prem
- Active TLS scanning
The hostnames are invented, the pattern is real: four of these five endpoints use a key exchange that a quantum computer will break. Today, all five look healthy.
Why now
Are you already too late?
Adversaries record encrypted traffic today and decrypt it once quantum hardware catches up — harvest now, decrypt later. Whether that makes you late already is arithmetic, not opinion. Three numbers, your numbers:
Data you encrypt today still needs protection in 2041 — 6 years after the quantum computer you just assumed. On your own numbers, you are 6 years too late.
What your regulator actually requires, and by when →
Nobody knows the arrival year: the US Office of Management and Budget confirmed in writing in June 2026 that no cryptographically relevant quantum computer is known to exist. That is why the third slider is yours to set. The other two are the ones you control.
Behind this sit real deadlines — the EU, Germany’s BSI, a US executive order — and FINMA’s guidance for the Swiss institutions it supervises.
The full picture, with sources →Migration reality
Post-quantum certificates are not a drop-in replacement.
A signature that fits in 64 bytes today takes thousands of bytes post-quantum — on every certificate, in every handshake.
Signature sizes from NIST FIPS 204; multiples relative to ECDSA P-256. A certificate chain carries several signatures and public keys, so the bytes multiply before they travel.
The question is not whether the network can carry the bytes — it is which endpoints, appliances and embedded clients cannot, and what every renewal touches. That is an inventory question.
See what a scan findsWhat it does
From “we think we know” to a list you can act on.
Discover
Find every endpoint, including the ones a network scan cannot reach
Active TLS scanning reads certificates, chains, protocols, cipher suites and forward secrecy from anything that speaks TLS. Where the network cannot look inside, a small scanner runs on the host itself.
- Reads the full TLS handshake, sweeps whole network ranges, and works through your proxies
- The host scanner covers Windows certificate stores, internal CAs and machines without internet access
- A DMZ, an isolated OT segment or a branch network is reached by a remote engine you deploy inside it — it dials out to Post Quantum Leap, so no inbound firewall rule is needed
- Host scanners in that segment submit to the engine rather than to the server, so they need no path out of it either
- Scan speed is adjustable down to stealth, so a scan never looks like an attack
- Import what you cannot scan: certificate files, CBOM, or a pasted host list
Inventory
One inventory that shows what every renewal touches
Endpoints and certificates sit in one table: one place to search, filter and export, instead of several tools that each hold part of the answer.
- See how many endpoints share a certificate before you replace it
- Trust chains are verified against the public CA stores, and every certificate keeps its history
- Filter by SAN, subject, CAA, reachability, forward secrecy or issuing CA
- Export any filtered view to Excel or a CycloneDX CBOM
Grade
Your definition of good, applied consistently
Start from one of two built-in policies: SSL Labs compatible, or strict post-quantum. Then change any single algorithm rule without losing the rest.
- Allow, forbid or cap the grade of individual protocols, ciphers, key exchanges and signature hashes
- Decide how much each category weighs, where grade boundaries sit, and when expiry counts as urgent
- A policy change re-grades everything instantly, without a new scan
- Every weakness comes with a recommended fix
Report
Report against the frameworks you are measured on
Ten framework packs, assessed continuously against your live inventory: NIST PQC, CNSA 2.0, BSI TR-02102, NIST IR 8547, PCI DSS 4.0, FIPS 140-3, ANSSI, MAS TRM — plus FINMA Guidance 05/2026 for the institutions a Swiss regulator supervises, and a harvest-now-decrypt-later view. They measure different things, so their numbers differ; each page shows what it actually checks.
- A quantum-safe handshake in front of a classical certificate is not counted as ready
- The FINMA view reports against Guidance 05/2026 as written — a recommendation rather than a circular, so its quantum rules warn where a binding rule would fail, and the report says which it is
- The harvest-now-decrypt-later view weighs how long recorded traffic must stay secret against the year its key exchange is estimated to break — and is labelled as our own model rather than a published standard, because it is one
- An asset nobody has labelled for sensitivity is left out of that percentage rather than counted as a failure
- Each pack states what it cannot see as plainly as what it can: FIPS 140-3 cannot establish CMVP module validation, and says so rather than implying it
- Per-endpoint evidence behind every verdict — one row per endpoint, naming the rule that decided it, and each row opens that endpoint
- Independent of your own grading policy, so an auditor sees the framework’s rules, not your local ones
- Export any pack to Excel
Proof
Don’t take our word for it.
A real scan, of this website
This is Post Quantum Leap scanning this very website, and reporting the hybrid post-quantum key exchange it negotiated.
Dependencies
See what actually depends on what
An interactive graph of services, protocols, cipher suites and algorithms for any target, coloured by post-quantum rating. Click a node and the whole chain around it lights up.
- Available for network-scanned targets as well as hosts running the client scanner
- Every node shows its post-quantum rating and the estimated year its algorithm stops being safe
- It turns “we should migrate” into “migrating this affects these four services”
Dashboards you can drill into
No number has to be taken on trust: click any tile, bar or row and you see the endpoints it counted.
-
Migration progress Quantum-safe against vulnerable, over time, so you can show real progress. -
What to do first Criticality against migration effort. The top-left cell is the work that matters most and costs the least. -
Post-quantum posture Everything you have, split into vulnerable, hybrid, quantum-safe and not yet classified. -
Key strength The key sizes actually in use. Anything below 2048 bits shows up red. -
Protocol hygiene In this example, SSL 3.0, TLS 1.0 and TLS 1.1 are still answering. Red is the list of things to switch off. -
Grades at a glance A to F across everything you have. Click a bar to see the endpoints behind it. -
Expiring soon The certificates that expire next, with the owner and business criticality already attached. -
Drill all the way down Worst grades first. Click a row to open that host, its chain and its certificates.
Why Post Quantum Leap
Why teams pick it.
It runs where your policy says it must
A complete map of your weakest cryptography is sensitive by definition, so you decide where it runs — up to fully air-gapped on your own hardware.
The policy is yours
Grading presets you can override algorithm by algorithm, not a vendor opinion baked into a score. Policies genuinely differ: Canton Bern, for instance, mandates FrodoKEM and Classic McEliece rather than ML-KEM.
Governance is built in
Owners, criticality and your own fields sit on the endpoint and survive every certificate renewal. Every change is recorded, and three roles are enforced everywhere, with Entra ID or any OpenID Connect sign-on.
Built in Switzerland
Post Quantum Leap is developed and supported by a Swiss company. The product, the people behind it and the support all sit under Swiss jurisdiction.
How it runs, and where
One container, one database, running where you choose.
- 01
Point it at your infrastructure
Paste a list of targets, import certificates as PEM or CBOM, or let a network sweep find them. Add host scanners where the network cannot reach.
- 02
Let it scan
Scans run in the background, on your schedule and in your timezone, with speed settings that keep intrusion detection quiet. Progress shows in the top bar.
- 03
Track the migration
Posture over time, a heatmap of criticality against migration effort, and a prioritised list of what to fix first.
The architecture and the three deployment models have their own page:
Architecture and deployment options →Request a live demo
See it live, then try it yourself.
Around 30 to 45 minutes, online. We drive: nothing to install, no environment to prepare, no data needed from you. We walk through discovery, the inventory, the crypto graph and compliance reporting on a full demo installation, then spend most of the time on whatever is closest to your situation.
If you want to keep going after that, we can give you a login to a demo tenant, or set you up with a local install so you can try it against your own infrastructure.
- What you get
- A straight answer on whether Post Quantum Leap fits your infrastructure, including when it does not.
- Prefer email
- info@postquantumleap.com
Request received.
We have emailed you a confirmation and will reply within one working day with a few suggested times. If nothing arrives, write to info@postquantumleap.com.