PRODUCT · COVERAGE
Cryptographic Coverage
Quantum Sentinel finds cryptography across eleven estate domains and classifies every observation against one vocabulary of classical and post-quantum algorithms. This page sets out what is covered, so you can check it against the estate you actually run.
Two ways to find cryptography
Cryptography shows up in two places. Some of it is visible on the network, and some of it is only visible inside the platform that holds it.
- Active assessment. Scanning workers placed inside your network probe endpoints and record what they negotiate: protocol versions, cipher suites, key exchange, certificates, SSH, remote desktop, file sharing, encrypted DNS and IPsec.
- Integration-based assessment. Read-only connections to the platforms you already run return the authoritative record inside them: the key never exposed to the network, the certificate not yet bound to a listener, the encryption a database enforces.
Both routes feed one inventory and one classification engine, so the same certificate found on the wire, in a cloud key vault and on an endpoint is assessed by the same rules.
Estate domains covered
| Estate domain | What Quantum Sentinel discovers |
|---|---|
| Networks and services | TLS directly and through STARTTLS across 55 crypto-relevant ports by default, SSH, remote desktop, Windows file sharing, encrypted DNS over TLS, HTTPS and QUIC, and IKEv2 key exchange. IPv4 and IPv6. |
| Certificates and PKI | Key algorithm, size, curve, signature algorithm, subject, issuer and validity, from endpoints and from Microsoft Active Directory Certificate Services. |
| Key management and HSMs | Key metadata from Thales Luna Network HSM, Thales CipherTrust Manager, HashiCorp Vault, OpenBao, CyberArk PAM, OpenStack Barbican and AWS KMS. Key material is never retrieved. Findings from third-party scanners and existing inventories are re-assessed against the same classification. |
| Cloud platforms | Key and certificate inventories across AWS, Azure, Google Cloud, Alibaba Cloud and Oracle Cloud Infrastructure, covering every configured region, location or compartment. |
| Databases | Nine engines: PostgreSQL, MariaDB, MSSQL, Oracle, MongoDB, CockroachDB, ClickHouse, Neo4j and Cassandra. The transport security negotiated on the scanner’s own session, the platform’s enforcement setting, and at-rest and column-level encryption. |
| Applications and source code | Algorithm use, weak and legacy primitives, protocol versions pinned in code, implementation defects such as predictable initialisation vectors, and embedded keys and secrets, which are always redacted. Seventeen languages, including Solidity and Vyper smart contracts. |
| Endpoints | Through CrowdStrike Falcon: cryptographic libraries with versions, listening services, certificate stores, keys, transport and authentication policy, and volume encryption. |
| Network security appliances | Certificate stores, VPN and IPsec proposals and management TLS posture on F5 BIG-IP, FortiGate, Palo Alto PAN-OS and Cisco ASA, which are frequently the real internet-facing TLS endpoint. |
| Containers and Kubernetes | The listening services inside a workload, the TLS each presents, and the certificates and key material mounted into it. |
| Operational technology and IoT | Assessed by the same engine under profiles built for fragile equipment: non-disruptive by default, with low-and-slow pacing available and workers deployed inside the segment. MQTT over TLS brokers are covered, including those that require client certificates. IoT and OT are first-class asset types. |
| File shares and data at rest | Encrypted files identified by content signature rather than file extension: encrypted archives, key containers, encrypted volumes, protected documents and message-level encryption. See file share discovery. |
Algorithms and standards covered
One classification vocabulary is applied to every observation, whatever route found it.
| Area | Covered |
|---|---|
| Asymmetric and curves | RSA scored by key size, DSA, finite-field Diffie-Hellman with group strength, ECDSA and ECDH. Curves include NIST P-256, P-384 and P-521, Brainpool, Curve25519 and Curve448, Ed25519 and Ed448, secp256k1, and the BN254 and BLS12-381 pairing curves. |
| Symmetric, hash and key derivation | AES at 128, 192 and 256 bits with authenticated and unauthenticated modes distinguished; Triple DES, DES, RC2, RC4 and RC5; ChaCha20-Poly1305; Blowfish, Twofish and CAST-128. MD5, SHA-1, the SHA-2 family, SHA-3 and Keccak-256, HMAC constructions and Poly1305. PBKDF2, bcrypt, scrypt, Argon2 and HKDF. |
| Post-quantum | ML-KEM (FIPS 203), ML-DSA (FIPS 204), SLH-DSA (FIPS 205), FN-DSA and Falcon, HQC, LMS and XMSS, NTRU and NTRU Prime, BIKE, FrodoKEM and Classic McEliece. Hybrid constructions are identified as hybrid rather than counted as either half. |
| Protocol parameters | SSL 2.0 and 3.0, TLS 1.0 to 1.3 and individual cipher suites; the SSH algorithm name-lists; IKEv2 encryption, integrity, pseudo-random function and Diffie-Hellman group transforms; remote desktop and file-sharing security settings; encrypted DNS and DNSSEC signing algorithms. |
| Web3 and smart contracts | Solidity and Vyper source is assessed for Ethereum Virtual Machine cryptographic constructs, and the curves involved are named correctly: secp256k1 for signature recovery, BN254 and BLS12-381 for pairing precompiles, and Keccak-256 distinguished from NIST SHA3-256. See smart contract discovery. |
| Cryptographic libraries | Endpoints report the cryptographic libraries, runtimes and operating-system providers present, each with its version, and each is asked directly whether it can perform ML-KEM and ML-DSA today. A component that cannot is reported as a prerequisite that gates migration. Web assessments also fingerprint client-side browser cryptography libraries. |
Post-quantum readiness, not only weakness
Quantum Sentinel records what an estate already supports as well as what is weak. Hybrid post-quantum key exchange is reported by name. A native probe detects strictly post-quantum servers that reject classical clients outright, which conventional scanners report as an empty result. Post-quantum SSH key exchange and post-quantum certificate keys are recognised.
Findings distinguish NIST standardisation (FIPS 203, 204 and 205) from inclusion in CNSA 2.0, because those are different claims. FN-DSA is recognised, but its standard, FIPS 206, is still in progress.
Source code: seventeen languages
Source assessment covers Go, Rust, C, C++, C#, Java, Kotlin, Scala, Python, JavaScript, TypeScript, Ruby, PHP, Swift, Objective-C, Solidity and Vyper. Platform-specific cryptographic vocabularies are recognised alongside generic algorithm names. Findings report the algorithm, the file, the line and the enclosing function. Read more on code repository discovery.
Safe by design
- Agentless. Nothing is installed on a target system.
- Metadata only. Private keys, secret values and file contents are never retrieved or stored. Secrets found in source code are recorded by location and kind, never copied.
- Read-only. Every integration is designed for a read-only account. No configuration on a target is changed.
- No traffic decryption. Negotiation and configuration are observed. Traffic is never decrypted, intercepted or proxied.
- Non-disruptive by default. Five scan profiles set pacing and disruption policy. Probes that can destabilise fragile or operational-technology equipment are withheld unless explicitly authorised, and what was withheld is recorded with the scan.
- Deployable anywhere. Distributed scanning workers pull work outbound, so no inbound path into a protected segment is needed, and the platform installs in air-gapped environments.
From inventory to action
Discovery feeds the continuous six-stage ECEM lifecycle: Discover, Inventory, Assess, Prioritise, Transition, Monitor. Every finding lands in a living Enterprise CBOM with risk classification, harvest-now-decrypt-later exposure informed by how long the data must stay confidential, replacement guidance against the post-quantum standards, and dependency relationships so that the blast radius of a single key or issuer can be answered.
Policy is evaluated continuously, with drift detection and alerting. Evidence exports as CycloneDX 1.7 and as a report set covering post-quantum readiness and the major regulatory frameworks, in PDF, Word, Excel and CSV. See the Cryptographic Discovery & CBOM page for how the inventory is built.
Frequently asked questions
Which cryptographic algorithms does Quantum Sentinel detect?
It recognises classical asymmetric algorithms and curves, symmetric ciphers, hashes and key derivation functions, and post-quantum algorithms including ML-KEM, ML-DSA, SLH-DSA, FN-DSA, HQC, LMS and XMSS. Every observation is scored against one classification, whether it was found on the network, in a key manager, in a database or in source code.
Does it detect post-quantum and hybrid cryptography already in use?
Yes. Hybrid key exchange such as X25519MLKEM768 is reported by name and identified as hybrid rather than counted as either half. A native probe also detects servers that only negotiate post-quantum groups, which conventional scanners report as an empty result.
What happens to an algorithm Quantum Sentinel does not recognise?
It is recorded and marked for review rather than ignored or guessed at. The finding stays in the CBOM so that a person can decide what it is.
Which estate domains are covered?
Networks and services, certificates and PKI, key management and HSMs, cloud platforms, databases, applications and source code, endpoints, network security appliances, containers and Kubernetes, operational technology and IoT, and file shares. Each is described in the table on this page.
Does Quantum Sentinel decrypt traffic or retrieve private keys?
No. It observes negotiation and configuration and records metadata. Private keys, secret values and file contents are never retrieved or stored, traffic is never decrypted, and every integration is designed for a read-only account.
Is FN-DSA covered, given that FIPS 206 is not final?
FN-DSA, the signature scheme based on Falcon, is recognised so that it is classified correctly if it appears. Its standard, FIPS 206, is still in progress. FIPS 203, 204 and 205 are the finalised NIST post-quantum standards.
How is Quantum Sentinel licensed?
Licensing is by number of assets.
Where can I get the detailed coverage document?
Request a demo or contact us and we will send the detailed coverage document, which includes the current platform list.
See what your estate is actually using.
Point Quantum Sentinel at one part of your estate and see the inventory it produces. Request a demo.