[PQ]probe finds the cryptography in use across an organisation (source code, dependencies, filesystems, networks, captured traffic, endpoints, and device inventories) and grades every finding against post-quantum deadlines. It runs inside your environment, air-gapped, and nothing leaves your network.
Ottenheimer GmbH was founded in Berlin in 2026 to build it. We also turn the same scanner outward: we measure what vendors and regulated sectors actually negotiate on the public wire and what open-source projects carry in their source, and we publish what we find. We are not a vendor of post-quantum algorithms. We scan, we grade, we publish, and we run migrations.
What we publish
The PQC Vendor Scorecard, quarterly. Major technology vendors by product category, from browsers and CDNs through networking, cloud, HSMs and databases to enterprise SaaS, checked against CISA's product category lists and against what their endpoints negotiate. Each edition records what moved since the last one and what did not. Free download, no gate. The Q1 (February), Q2 (July) and Q3 2026 (November) editions are in [PQ]files; pqprobe.com/scorecard always opens the latest. Since October 2026 the scored products' endpoints are scanned once a day; the Vendor Monitor shows each product's standing beside what its dated vendor material says.
The NIS2 Monitor, continuously. We maintain a scan population of regulated entities across the NIS2 Annex I and II sectors (currently more than 1,400 public endpoints), graded A–F on every scan and tracked for trajectory: improving, degrading, or stable. Results are published in the NIS2 Monitor and in sector reports.
The OSS Monitor, continuously. The same question, asked of source code: we read public repositories with [PQ]probe's static analysis at each one's current commit and record which public-key cryptography a project names itself and whether post-quantum algorithms are already there. The first cohort is the open-source projects funded by the Sovereign Tech Agency. Every project with public-key cryptography gets a code grade from A to F: A has post-quantum key exchange and signatures in its own source, B one of the two, C neither with its classical algorithms coming through a dependency or configuration, D neither with a protocol or format fixing a classical algorithm, and F neither with a classical primitive implemented in the project's own code. Each finding carries the commit it was read at, and each post-quantum project the first commit that introduced a post-quantum identifier. Results are published in the OSS Monitor.
Method and analysis. Where measurement needs a method, we publish the method: how edge-delivered post-quantum key exchange is attributed to a CDN rather than to the organisation behind it, why widely cited adoption figures are a floor rather than a ceiling, and what a grade does and does not claim. Where a vendor announcement, a regulatory deadline, or a cryptanalytic paper changes the picture, we say what changed and what did not.
How the published measurements work
- Scans run from our own infrastructure with the same reach any client has. Nothing is inferred from questionnaires or vendor statements. A named algorithm can be probed; “quantum-safe architecture” cannot.
- 20 protocol scanners (TLS, SSH, SMTP, IMAP, RDP, database, healthcare, and messaging) cover 66 ports.
- A host's grade is its worst probe. Averages hide the weak link.
- A probe the server answers is accepted or refused. A close that comes again after a canary hello shows the server up, or silence to a lone key-exchange group after that canary, is a refusal. A probe that gets no answer after a retry is recorded as unknown, never as a refusal, and the scan is marked incomplete. Grades are computed on answered probes only.
- Code measurements read a repository at its current commit and grade what the project's own source names. A dependency upgrade can change what runs at runtime, not the letter. Each repository is rescanned when its commit changes, and on every new scanner version.
- Published figures include only scheduled scans of the declared population. Public one-off scans are excluded.
- Operators and maintainers can opt out by emailing abuse@pqprobe.com with a hostname, range or repository.
Corrections are published in place. The Q2 Scorecard records two Q1 errors and what replaced them.
Working with us
The same seven discovery methods, on your own estate. Network scans, SMB and the database, mail, directory and healthcare protocols included, passive captures and Defender imports are stored, exported as CBOM, SARIF and CSV, and collected with pqprobe push from every machine into one inventory on your own instance. Deployment is a single binary, on-premises or air-gapped.
- Free probe: check any host, repository, or dependency tree at pqprobe.com/app, with mapping to NIS2, CNSA 2.0, and PCI DSS.
- Guidance Mode: full [PQ]probe access for your team, with monthly expert hours and findings review, for organisations running their own migration.
- Project Mode: inventory, assessment, grading, and a sequenced roadmap with a dated trajectory, delivered by our team in your environment. Enterprise engagements are delivered with esatus AG.
- Research access: independent researchers, academics, and journalists can use [PQ]probe under a non-commercial licence, with version and checksums provided so results can be reproduced and published.
Team
Ottenheimer GmbH was founded by Davi Ottenheimer, who led security at Yahoo!, EMC, VMware, ArcSight, and MongoDB, including large, complex cryptographic migrations. He joined MongoDB to bring field-level encryption to document databases, creating the project and leading it through its first release, and established the company's CISO role.
“Here to help shrink the gap between what vendors say about your preparedness and what their products actually negotiate.”
Contact
hello@pqprobe.com: engagements, press, research, corrections, and everything else.
Ottenheimer GmbH · Berlin, Germany · Impressum