Report & score
One page your board can read.
Score a CBOM, read a plain-language summary of its post-quantum posture, and print or save the report as a PDF. Everything runs in your browser — nothing is uploaded.
Readiness score
83/100
A usable inventory with a few gaps to close and some assets to strengthen. Scores and readiness labels are explanatory heuristics computed from asset names — not a security certification.
Executive summary
What this means in plain language
sample-gateway lists 3 cryptographic assets linked by 3 relationships.
1 asset relies on classical public-key or deprecated cryptography (RSA-2048) that a cryptographically relevant quantum computer could break — the main driver of the score.
1 asset needs follow-up: protocols and certificates inherit their strength from the algorithms inside them, and some entries lack the detail needed for a confident assessment.
1 asset already maps to standardized, quantum-resistant cryptography.
Overall grade B (83/100). A usable inventory with a few gaps to close and some assets to strengthen.
Findings
What the validator saw
Core structure looks usable
The document parsed successfully and identifies its CycloneDX CBOM structure.
1 asset needs post-quantum migration
RSA-2048 uses classical cryptography that a cryptographically relevant quantum computer would break. Plan migration to ML-KEM and ML-DSA.
Actions
What to do first
- RSA-2048algorithmMigration neededPlan migration
Plan digital-signature migration → ML-DSA (FIPS 204)
- TLS 1.3protocolTrack configurationStrengthen
Inventory the algorithms negotiated inside it → Hybrid post-quantum key exchange where available
- AES-256-GCMalgorithmQuantum-resistantMonitor
No change required → AES-256 is considered sufficient
No account · no upload · no retention