Scan

From a handshake to a plan.

Scan checks the public endpoints you list, once someone who can speak for those names confirms them in writing. It notes the protocol, the key-exchange group and the certificate algorithm, then hands you a checklist and a CBOM.

Request a pilot scan Play the sequence

Drag or touch the field. It ripples, then settles.

Illustrative

A scan, played out

Made-up hostnames on example.com. Sample data shown is illustrative.

Illustrative scanexample.com

Endpoints you listed

www.example
api.example
status.example
git.example

Made-up names. Sample data shown is illustrative. Nothing here is a customer.

Handshakes inspected

www.example

TLS 1.3

Key exchange: X25519MLKEM768
Certificate: ECDSA P-256

api.example

TLS 1.3

Key exchange: X25519
Certificate: ECDSA P-256

status.example

TLS 1.0 and TLS 1.2

Key exchange: X25519
Certificate: RSA-2048

git.example

SSH

Key exchange: curve25519-sha256
Host key: ssh-ed25519

Sample data shown is illustrative.

Algorithm inventory

www.exampleX25519MLKEM768 · ECDSA P-256
api.exampleX25519 · ECDSA P-256
status.exampleX25519 · RSA-2048
git.examplecurve25519-sha256 · ssh-ed25519

X25519, curve25519-sha256, ECDSA P-256, RSA-2048 and ssh-ed25519 are quantum-vulnerable public-key algorithms. X25519MLKEM768 adds ML-KEM alongside X25519. Sample data shown is illustrative.

CBOM export

Illustrative CycloneDX excerpt

{
  "bomFormat": "CycloneDX",
  "components": [
    { "name": "X25519MLKEM768" },
    { "name": "X25519" },
    { "name": "ECDSA-P256" },
    { "name": "RSA-2048" },
    { "name": "ssh-ed25519" }
  ]
}

Migration checklist

Retire TLS 1.0 and TLS 1.1 on status.example.
Offer X25519MLKEM768 where the key exchange is still X25519 alone.
Plan ML-DSA certificates beside the classical signatures.
Note the SSH host key on git.example in the same inventory.

Sample data shown is illustrative.

Quanveil shares results only with you and does not publish them. Scan has no hosted service, so results are not uploaded to one.

Illustrative

Scan a made-up endpoint

Nothing here is live. Pick a fictional host and watch each algorithm named, one at a time. This is an illustration. It does not judge the endpoint.

Sample data shown is illustrative.

Pilot

How a pilot works

Steps 1 to 3 commit you to nothing, and nothing is signed. A pilot runs only under written pilot terms that both sides agree and sign.

01 · Request
Tell us which public endpoints you would like checked. List only names your organization runs.
02 · Call
A short call about scope and questions.
03 · Demo
See an illustrative scan on made-up hostnames, and what the write-up contains.
04 · Letter of intent
If you choose to continue, a short letter of intent. It does not commit you to a pilot or to any payment. Only its confidentiality terms, and any other clauses it marks as binding, bind either side.
05 · Pilot
Under the written pilot terms, Scan checks only the public endpoints you listed, after someone who can speak for those names confirms them in writing. It reads what each endpoint offers when a connection is set up. It does not sign in, change anything, or test for weaknesses.
06 · Readout
You receive the observations, a migration checklist and a CycloneDX CBOM. They are point-in-time observations of those endpoints on the date shown, not a certification, audit or guarantee of any result.

Your data in a pilot. We handle the names you list, your contact details and the scan output. Quanveil shares results only with you and does not publish them. The written pilot terms say where results are stored, who can see them and when they are deleted. To read certificate history, Scan may look up the names you listed in public certificate-transparency logs run by third parties.

Request

Request a pilot scan

Or write to hello@quanveil.com.

Requests open soon. Email hello@quanveil.com. hello@quanveil.com