A probe scans every protocol surface that negotiates cryptography—TLS, SSH, SMTP, IMAP, RDP, database protocols, healthcare protocols, message brokers, filesystem sharing. 20 protocol scanners across 66 ports. A stored scan is graded A through F, a TLS endpoint stays at C or below until it negotiates post-quantum key exchange, and every stored result feeds a temporal trajectory—IMPROVING, DEGRADING, or STABLE—so you always know whether your migration is on pace. Seven discovery methods: network scans, SMB and the database, mail, directory and healthcare protocols included, passive capture, filesystem scans, Windows audits and Defender import feed the stored inventory, each exported as what it is, and pqprobe push uploads the inventory of every machine that runs the CLI to your own instance, which grades each scan again and keeps it under the uploading key. A filesystem scan is stored under a label, each file known by a keyed hash of its path, a Windows audit under the machine's name, with logon counts and no logon details, a dependency audit as an ungraded inventory under a label, and a code analysis the same way, from a record classified on the machine that read the code, with no code, messages or paths outside the tree. Pick the one that fits your workflow, or use them all.
pqprobe push; the other methods report on their own.
Full protocol list
Find every cryptographic service on your network. 35 service types on 66 ports, 20 protocol scanners, each grading and storing the TLS its protocol negotiated; the SSH and FHIR scanners report without storing.
Analyze captured traffic from SPAN ports or network taps. 13-protocol detection. No agents, no active connections. Ideal for medical devices, SCADA, and OT networks.
Find cryptographic usage in source code before it ships. Block weak crypto in CI/CD with exit-code gating.
import static and uploaded with pqprobe pushWhich dependencies use cryptography, whether they're quantum-safe, and the minimum version to upgrade to.
Scan filesystems for certificates, keys, and crypto configs. Know what's stored where.
Audit local machine crypto configuration. Registry settings, security policies, NTLM authentication.
Import Microsoft Defender for Endpoint software inventory exports. Zero-deployment crypto library census across large fleets.
Each host is marked IMPROVING, DEGRADING or STABLE from its trailing scans, and its rate of change is projected onto the deadlines it answers to.
Tarball with binaries, systemd unit, config template, and step-by-step install guide. Extract, configure, start.
Set PQPROBE_REQUIRE_AUTH to gate all non-public routes behind API key or OAuth. Bootstrap admin key generated on first run.
Container images for server, CLI, and static analyzer. Single-container deployment with embedded workers and SQLite.
No telemetry, no license server, no update checks. Outbound connections go to the targets you scan, and to GitHub, Jira or an alert webhook only when you configure them.
We assess your cryptographic posture, deploy [PQ]probe on your infrastructure, and leave you with continuous monitoring that runs on your network.