Skip to content
Quantum Security · QBOM

Prepare your cryptography for the quantum era.

Discover quantum-relevant cryptographic assets, assess post-quantum readiness, and turn cryptographic findings into a prioritized migration plan.

Explore QBOM

Part of EndSecure early access. Join the waitlist to be first in line.

Illustrative sample data

From codebase to migration priorities

QBOM, the Quantum Bill of Materials, follows the same five steps every time, and shows its working at each one.

What QBOM does

A post-quantum readiness assessment that your security and engineering teams can both read.

  • Cryptographic discovery

    Algorithms, certificates, protocols, keys by fingerprint only, and the crypto libraries your code depends on.

  • Quantum risk assessment

    Quantum ready, quantum vulnerable, migration required, review required or unknown, each with its reasons.

  • Crypto dependency mapping

    See which services and packages pull in which cryptography, directly or through dependencies.

  • Migration prioritization

    Findings grouped into P0 Immediate, P1 High, P2 Planned and P3 Monitor.

  • Readiness tracking

    Re-scan as you migrate and follow each item from Discover to Verify.

  • Audit-ready reports

    JSON, CSV, a printable report and a CycloneDX-compatible CBOM export.

Every score comes with its reasons

Five classifications and a transparent risk score, with the evidence behind each one, so a finding can be checked rather than taken on trust.

  • Five classificationsQuantum ready, Quantum vulnerable, Migration required, Review required and Unknown.
  • A score you can add upEvery factor and its weight are listed next to the asset.
  • Symmetric crypto is reviewedAES and similar algorithms are marked Review required, never assumed safe.
Illustrative sample data

From findings to a migration plan

Findings become a prioritized plan and a roadmap your engineering teams can work through at their own pace.

  • Four prioritiesP0 Immediate, P1 High, P2 Planned and P3 Monitor.
  • A six-stage roadmapDiscover, Classify, Prioritize, Plan, Migrate and Verify.
  • A suggested directionEach item carries a next step, for your teams to test and confirm.
Illustrative sample data

Track readiness, export what you need

Re-scan as you migrate, watch the open items fall, and share results as JSON, CSV, a printable report or a CycloneDX-compatible CBOM.

Illustrative sample data

What it is, and what it is not

Plain boundaries, so nobody reads more into a report than it says.

What it is

  • A post-quantum readiness assessment of the cryptography in your code and dependencies
  • An explainable inventory: every classification and score shows its reasons
  • A prioritized migration plan, and a way to track it over time
  • A CycloneDX-compatible CBOM export for the other tools you use

What it is not

  • Not a promise that any system is safe from quantum attacks
  • Not a replacement for review by your own cryptography engineers
  • Not an automatic migration: QBOM plans the work, your teams make the changes
  • Not a certification against any standard

Worth knowing: QBOM reports potential quantum-vulnerable cryptographic usage in the sources you provide. Cryptography created at runtime, hidden in compiled binaries or living in systems you have not uploaded may not appear; anything referenced but not identified is marked Unknown.

QBOM questions, answered plainly.

What EndSecure does, what it doesn’t, and how it fits with your tools.

See all questions
What is QBOM?
QBOM, the Quantum Bill of Materials, is a post-quantum readiness assessment. It builds an inventory of the cryptography found in an uploaded codebase, a dependency inventory or an imported CycloneDX CBOM, classifies each asset, explains its risk score and turns the results into a prioritised migration plan.
Will QBOM make our systems quantum secure?
No. QBOM points out potential quantum-vulnerable cryptographic usage and helps you plan and track the migration. Your teams make the changes, and the readiness figures are a planning aid, not a certification.
What does QBOM read, and does it collect keys?
It reads source code, dependency manifests and lockfiles, or a CycloneDX CBOM you import, and records algorithms, certificates, protocols and crypto libraries with where they appear. Keys are identified by fingerprint only; key material is not kept in the inventory.
Is symmetric encryption such as AES automatically safe?
Not automatically. Symmetric algorithms are generally less exposed than public-key algorithms, so QBOM marks them Review required rather than ready: key size, mode and how the keys are exchanged still deserve a look.

The EndSecure platform

Part of one platform

QBOM and DPDP Saf sit beside the six AI security modules, in the same console, with the same roles and audit logs.

AI SecuritySix AI security modulesSee the AI your people use and stop sensitive data before it reaches it.
  • Shadow AI discovery
  • EndSecure DLP
  • Policy and enforcement
  • Endpoint security
Explore AI securityPrivacyDPDP SafMap personal-data flows and find DPDP control gaps before they become problems.
  • Consent audit
  • Data mapping
  • Retention review
  • Data Principal rights
Explore DPDP SafYou are hereQuantum ReadinessQBOMKnow where your cryptography lives and plan its post-quantum migration.
  • Crypto inventory
  • Quantum risk
  • Migration planning
  • Readiness tracking
Explore QBOM

EndSecure

Security for today’s threats. Readiness for tomorrow’s.

  • AI Security
  • Privacy
  • Quantum Readiness

Early access

Prepare your cryptography for the quantum era.

Upload a codebase or import a CBOM during the free evaluation and see your first QBOM and migration plan.

  • Onboarding early customers
  • Every module included
  • Early-access pricing first

Join the waitlist

We are onboarding early customers. Join the waitlist to get early access.