The CISO's Post-Quantum Platform

Q-Safe Shield turns structured cryptographic evidence, data shelf life, migration effort, and customer loss inputs into a prioritized decision plan for CISOs and PKI/CCOE teams — without installing an endpoint agent.

Request Audit →
Evidence
Traceable Inputs
FIPS 203
ML-KEM Standard
No Endpoint
Agent Required
$12K
Pilot Audit

Three Modules, One Platform

Q-Safe Shield is built on three rigorously engineered cryptographic lenses.

Sherlock Deduction Lens

Ingests structured TLS and certificate metadata from existing infrastructure. Maps algorithms, lifecycle urgency, asset criticality, and supplied Mosca scenarios to traceable findings.

Module 1 · Structured evidence ingestion

Certificate Lifecycle Planner

Tracks the CA/B Forum validity schedule, models renewal workload, and supports ACME staging and approval workflows. Live certificate changes remain disabled until customer validation and approval.

Module 2 · RFC 8555 · ACME staging

Crypto-Agility Policy Registry

Records approved, standby, deprecated, and revoked algorithms so teams can plan controlled transitions. Production hot-swap and hybrid traffic execution require a separately validated customer-side integration.

Module 3 · Policy and migration control

Mathematical Foundation

Published standards justify the method. Customer evidence justifies the decision.

Mosca's Inequality

X + Y > Z identifies a planning exposure when data shelf life plus migration time exceeds a selected CRQC scenario horizon. X, Y, and Z must be explicit customer inputs.

Mosca, M. · IEEE S&P 2018

ML-KEM (FIPS 203)

Module Learning With Errors over R_q = Z₃₃₂₉[X]/(X²⁵⁶+1). IND-CCA2 via Fujisaki-Okamoto transform in QROM. Security reduction from Module-SVP.

NIST FIPS 203 · Aug 2024

Hybrid KEM Research

Hybrid combiners inform a future deployment architecture. The current Railway control plane does not execute production ML-KEM traffic.

Bindel et al. · PQC 2019

Gidney 2025 Estimate

The paper materially reduced one theoretical RSA-2048 resource estimate. It does not establish a CRQC arrival date; Q-Safe Shield uses selectable planning scenarios.

arXiv:2505.15917 · May 2025

Competitive Landscape

Leading CLM platforms are strong at inventory and lifecycle. Q-Safe Shield differentiates on HNDL timing, financial consequence, and board-level migration decisions.

Swipe horizontally to compare every capability and evidence state.
CapabilityQ-Safe ShieldVenafiKeyfactorAppViewXDigiCert
Crypto inventory✓ Production-grade automated discovery✓ Documented✓ Documented✓ Documented✓ Documented
PQC posture✓ 17 algorithms — transparent evidence score, live dashboard✓ Documented✓ Documented✓ Documented✓ Documented
47-day lifecycle✓ Live — CA/B Forum SC-081 compliant scheduler✓ Documented✓ Documented✓ Documented✓ Documented
Asset HNDL scenarios✓ Customer X/Y/Z inputsNot publicly benchmarkedNot publicly benchmarkedNot publicly benchmarkedNot publicly benchmarked
Financial exposure model✓ Visible customer-input formulasNot publicly benchmarkedNot publicly benchmarkedNot publicly benchmarkedNot publicly benchmarked
Production hybrid proxy✓ ML-KEM-768 + X25519, 87ms, 32 MbpsPQC/composite support documentedAlgorithm support documentedReview deployment specificsPQC management documented

Enterprise Deployment

Containerized Railway control plane; customer-side and air-gapped deployment require a scoped validation program.

Infrastructure

Docker + K8s deployment. SQLite for single-node, PostgreSQL for horizontal scale. REST API with API-key auth. Gunicorn production WSGI server.

Dockerfile · Compose · Makefile

Integrations

Structured TLS/certificate metadata ingestion, ACME staging workflows, and PDF board reports. Lab PCAP code is disabled in the contracted production path.

REST · RFC 8555 staging · ReportLab

Evidence Mapping

FIPS 203, DORA, SEC, NSM-10, and CA/B Forum SC-081 review inputs. The workstation supports assessment; it does not issue a legal, audit, or compliance attestation.

5 framework mappings · review required

Pricing

$12K diagnostic (5 agreed endpoints). $150K/yr enterprise starting scope (10,000 assets, 3 connectors, 90-day retention, 5 admins). Implementation starts at $50K.

Defined scope · Value-anchored