PITOWINGS — Secure Everywhere
The category-defining PQC posture platform

Master your cryptographic posture.Shield your enterprise from quantum exposure.

Next-Gen PQC-SPM is the world’s first 100% agentless, air-gapped Post-Quantum Cryptography Security Posture Management platform. Continuously discover cryptographic assets across source code, live TLS networks, cloud KMS and compiled binaries. Automate OWASP CycloneDX 1.7 CBOM generation, quantify Harvest Now Decrypt Later risk, and refactor legacy code to NIST FIPS 203, 204 and 205 in minutes.

Read-only & agentless

Zero runtime impact. Zero production attack surface.

Air-gapped & offline

Zero telemetry. Zero external calls. Full data residency.

Compliance out of the box

CNSA 2.0, EU DORA, PCI DSS 4.0.1 and OMB M-26-15.

Explore the platform

100%

Agentless & read-only

0

Bytes of outbound telemetry

4

Discovery surfaces

<5

Minutes to first CBOM

Trusted by financial institutions, defence contractors, telecom operators and healthcare enterprises

NSA CNSA 2.0 CompliantEU DORA ReadyPCI DSS 4.0.1 §12.3.3OWASP CycloneDX 1.7 NativeFIPS 203 / 204 / 205 AlignedNIST IR 8547 TrackedOASIS SARIF 2.1.0Air-Gap & SCIF SafeNSA CNSA 2.0 CompliantEU DORA ReadyPCI DSS 4.0.1 §12.3.3OWASP CycloneDX 1.7 NativeFIPS 203 / 204 / 205 AlignedNIST IR 8547 TrackedOASIS SARIF 2.1.0Air-Gap & SCIF Safe
The executive problem

The quantum countdown has already started

State-sponsored actors are intercepting and storing encrypted enterprise payloads today — core banking ledgers, patient records, defence blueprints, trade secrets. When cryptographically relevant quantum computers arrive between 2028 and 2030, every classical asymmetric algorithm protecting that data is decrypted retroactively.

Mosca’s theorem — exposure check

XTime to quantum break
2028 – 2030

Cryptographically relevant quantum computers

YEnterprise migration duration
3 – 5 years

Discovery, refactoring, rollout, validation

ZRequired data secrecy life
10 – 30 years

Banking ledgers, health records, defence blueprints

Z + Y>X

When the secrecy your data still needs, plus the years your migration will take, runs past the day the maths breaks — the payload being harvested today is already lost. Most enterprises are already past this line.

The legacy blind spot

None of this is visible to the tools most enterprises already own.

  • Keys buried in compiled binaries

    Hardcoded RSA and ECC keys hidden deep inside ELF, PE and Mach-O executables and third-party JARs, where no source scanner will ever reach them.

  • Legacy TLS on internal services

    TLS 1.0 and 1.1 with vulnerable RSA cipher suites still negotiating quietly between microservices that never appear in an external scan.

  • Unrotated keys across three clouds

    Asymmetric customer-managed keys scattered across AWS KMS, Azure Key Vault and Google Cloud KMS, unmonitored and long past rotation.

  • Spreadsheets passing as a CBOM

    Manual, months-old inventories submitted to regulators as a Cryptographic Bill of Materials, with no lineage and no way to prove completeness.

  • Refactoring friction on the floor

    Developers asked to migrate to ML-KEM and ML-DSA by hand, across thousands of call sites, with no reference patch and no build-time guardrail.

Platform architecture

The complete PQC posture lifecycle

Five stages, one binary, no agents — from first discovery to continuous governance.

01

Discover

  • AST source code
  • TLS network probing
  • Cloud KMS & Vault
  • Compiled binaries
02

Analyze

  • CycloneDX 1.7 CBOM
  • ML-BOM AI tracking
  • Cryptographic drift
  • NHI service mapping
03

Score

  • Mosca HNDL risk
  • NIST levels 0–5
  • Data longevity class
  • Crypto-agility index
04

Remediate

  • FIPS 203/204/205 diffs
  • Unified .patch files
  • SARIF 2.1.0 for CI
  • Auto pull requests
05

Govern

  • CNSA 2.0 & EU DORA
  • PCI DSS 4.0.1
  • OMB M-26-15
  • PDF / DOCX audit packs
Core pillars

Built for the whole migration, not one slice of it

01

Multi-modal agentless discovery

Find every cryptographic primitive, key, certificate and cipher suite across the estate without installing a single agent.

AST source code analysis
Abstract Syntax Tree scanning across Go, Python, JavaScript/TypeScript, Java, C/C++, Rust and C#. Flags hardcoded keys, legacy PKCS1v1.5 padding and deprecated primitives.
Active network & socket probing
Passive, non-disruptive TCP/TLS inspection detecting live handshakes, SSH negotiation and elliptic curves across local interfaces and CIDR subnets.
Stateless cloud KMS & vault audit
Read-only inspection of AWS KMS, Azure Key Vault, Google Cloud KMS and HashiCorp Vault. Maps unrotated customer-managed and asymmetric key pairs.
CGO-free binary & container inspection
Native parsing of ELF, PE, Mach-O and Java archives. Reads symbol tables, dynamic linking tables and embedded PEM key blocks with no source access at all.
02

Standardised CBOM & ML-BOM inventory

Turn fragmented crypto assets into machine-readable, regulator-ready bills of material.

OWASP CycloneDX v1.7
Native export of full Cryptographic Bill of Materials payloads capturing algorithm specifications, key sizes, execution contexts and mathematical primitives.
Machine Learning BOM (ML-BOM)
Tracks cryptographic primitives embedded inside AI models, fine-tuned weights and framework SDKs including LangChain, HuggingFace, PyTorch and Ollama.
Lineage & dependency trees
Maps the complete hierarchy from application code, through the crypto SDK or library, down to the underlying cryptographic algorithm.
Non-human identity mapping
Associates every discovered key and certificate with the service, workload or pipeline that actually uses it, so ownership is never a guess.
03

Mosca HNDL risk & quantum scoring

Prioritise by real exploitability and data shelf-life instead of by raw finding count.

NIST quantum security levels 0–5
Every asset rated from Level 0 (RSA-2048, ECC P-256, DSA) through Level 5 (AES-256, ML-KEM-1024, ML-DSA-87) on a single comparable scale.
HNDL longevity calculator
Classifies assets into Critical (secrecy needed beyond 10 years), Moderate (3–10 years) and Low (under 3 years) using automated data-classification heuristics.
Cryptographic drift detection
Diffs each scan against the previous baseline and alerts on newly introduced weak ciphers, low-bit RSA keys and unencrypted endpoints.
Board-ready exposure reporting
Converts the Z + Y > X result into a single executive exposure figure that a risk committee can actually act on.
04

Automated remediation & crypto-agility

Close the gap between finding the problem and shipping the fix.

Unified .patch generation
Context-aware diffs that replace vulnerable legacy constructs with quantum-safe abstractions, ready to apply or open as a pull request.
NIST PQC refactoring playbooks
Built-in migration paths to FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) for every supported language.
CI/CD guardrail enforcement
Exports OASIS SARIF 2.1.0 to GitHub Code Scanning, GitLab Security Dashboards and Azure DevOps, with build-blocking rules that stop new quantum debt merging.
Crypto-agility scoring
Measures how quickly each codebase could swap algorithms again, so the next transition is not another multi-year programme.
Quantum scoring

NIST quantum security levels

Every asset lands on one comparable scale, so remediation is ordered by exposure rather than by finding count.

0

Vulnerable to a quantum adversary

RSA-1024, RSA-2048, ECC P-256, DSA, Diffie-Hellman

Breakable
1

Symmetric baseline

AES-128, SHA-256

Quantum safe
3

Standard quantum safe

AES-192, FIPS 203 ML-KEM-768

Quantum safe
5

Maximum resilience

AES-256, FIPS 203 ML-KEM-1024, FIPS 204 ML-DSA-87

Quantum safe
Automated remediation

From finding to merged fix

The platform does not hand you a report and wish you luck. It writes the patch.

crypto/keygen.go · quantum-safe.patch

-keys, err := rsa.GenerateKey(rand.Reader, 2048)

+

FIPS 203 ML-KEMUnified .patchAuto pull request

FIPS 203

ML-KEM key encapsulation

FIPS 204

ML-DSA digital signatures

FIPS 205

SLH-DSA hash signatures

Compliance engine

Every mandate, on one timeline

Complex regulation turned into real-time pass/fail scorecards, executive audit matrices and actionable remediation checklists.

2025NSA CNSA 2.0 — Milestone 1

Post-quantum signing becomes mandatory for new software and firmware delivered to national security systems.

2025PCI DSS v4.0.1 — Requirement 12.3.3

A documented cryptographic asset and cipher suite inventory becomes mandatory for every cardholder data environment.

2025EU DORA — Articles 8, 9 and 30

Financial entities across all 27 member states must track ICT cryptographic assets and third-party dependencies.

2026US OMB M-26-15 / M-23-02

Federal agencies owe an annual automated cryptographic inventory to CISA — a CBOM, not a spreadsheet.

2027NSA CNSA 2.0 — Milestone 2

Post-quantum support becomes mandatory for all new equipment acquisitions.

2030NIST IR 8547 — Deprecation

RSA-2048 and ECC are formally deprecated. PQC becomes mandatory for web and network equipment.

2035NIST IR 8547 — Disallowed

Legacy asymmetric encryption is strictly disallowed across all systems. There is no extension after this date.

US OMB M-23-02 / M-26-15

Federal cryptographic asset inventory mandate requiring annual CBOM reporting to CISA.

NSA CNSA 2.0

Tracks compliance across all five mandatory adoption phases — 2025, 2027, 2030, 2033 and 2035.

PCI DSS v4.0.1 §12.3.3

Automated inventory and cipher suite reporting for cardholder data environments.

EU DORA

Articles 8, 9 and 30 ICT encryption and dependency tracking across 27 EU nations.

NIST IR 8547

Automated tracking of the 2030 deprecation and 2035 disallowance dates for classical cryptography.

OWASP CycloneDX 1.7

Standards-based CBOM and ML-BOM output that downstream tooling can consume directly.

Competitive analysis

Why teams replace what they already own

CapabilityLegacy scannersHeavy enterprise suitesNext-Gen PQC-SPM
FocusGeneric SAST, code onlyHeavy PQC focus at $100k–$500k ARRDedicated, category-defining PQC-SPM
Deployment architectureCloud SaaS, agent-heavyMulti-agent infrastructureSingle static binary, agentless and air-gapped
Discovery scopeSource code text onlyNetwork or code, sold as siloed productsCode AST + TLS network + cloud KMS + binaries
CBOM standardNone, or a basic SBOMProprietary formatsOWASP CycloneDX 1.7 CBOM and ML-BOM, native
HNDL risk scoringNoneManual severity ratingsAutomated Mosca Z + Y > X longevity engine
Remediation outputGeneric text adviceConsultation recommendationsAutomated unified .patch diffs for FIPS 203/204/205
Time to valueMinutes to hours6 to 18-month deployment cyclesFirst CBOM in under five minutes
Data privacyCloud phone-home requiredExternal API calls requiredZero telemetry, fully offline, air-gap safe
How it works

From zero visibility to quantum resilience

Four steps. No agents, no collectors, no data pipeline to build.

01

Deploy the agentless probe

Run a single static binary. Connect read-only Git credentials, point it at network CIDR ranges, cloud accounts or container registries. Nothing is installed on a target server.

02

Generate the CBOM and score HNDL

Every cryptographic asset is normalised into a CycloneDX 1.7 CBOM, then scored for data-longevity exposure using Mosca's theorem and rated on the NIST quantum level scale.

03

Refactor to NIST PQC standards

Select the flagged findings and generate patches. You receive context-aware diffs that swap legacy primitives for ML-KEM, ML-DSA or SLH-DSA implementations.

04

Enforce guardrails and report

Push SARIF into your pipeline to block pull requests that reintroduce weak ciphers, and export executive PDF or DOCX compliance briefs for auditors and the board.

Air-gapped architecture

Engineered for the environments nothing else reaches

Classified SCIFs, air-gapped financial networks and critical national infrastructure — where a phone-home is a disqualification, not an inconvenience.

Pure-Go engine

Zero external CGO dependencies. One binary runs on Linux, macOS and Windows with nothing to install alongside it.

Embedded datastore

Self-contained encrypted local datastore with automated schema migrations. No database cluster to stand up.

Air-gapped licensing

Hardware node-bound licence verification using Ed25519 signatures. Activation never requires an internet round trip.

Zero phone-home

Operates entirely isolated inside classified SCIFs, DMZs and private clouds. No outbound telemetry of any kind.

Role-based access control

Argon2id password hashing and HS256 JWT sessions, with granular roles for auditors, engineers and administrators.

SAML 2.0 & OIDC ready

Native enterprise single sign-on that integrates directly, with no SaaS proxy sitting in the middle of your identity flow.

Licensing

Enterprise capability without the enterprise invoice

An annual licence, priced an order of magnitude below the heavyweight suites — because the engine is one binary, not a services programme.

Enterprise Starter

Mid-market organisations, product teams and regional defence suppliers taking their first inventory.

$1,499/ year
  • Up to 25 repositories and 250 assets
  • AST source code + compiled binary discovery
  • CycloneDX 1.7 CBOM export
  • SARIF 2.1.0 CI/CD integration
  • NIST quantum level scoring
Most chosen

Enterprise Core

Banks, insurers, healthcare groups and technology platforms running a funded migration programme.

$5,999/ year
  • Unlimited repositories and assets
  • Adds TLS network probing + cloud KMS audit
  • Mosca HNDL risk engine and drift detection
  • Automated FIPS 203/204/205 patch generation
  • CNSA 2.0, EU DORA and PCI DSS compliance packs

Defence & Air-Gapped

Defence organisations, federal agencies and critical national infrastructure operating offline.

$17,999/ year
  • Everything in Enterprise Core
  • Node-bound Ed25519 air-gapped licensing
  • SCIF, DMZ and private-cloud deployment support
  • SAML 2.0 / OIDC single sign-on and RBAC
  • Named engineer and audit-ready evidence packs

Annual licence per organisation. Indian customers may be invoiced in INR; GST extra where applicable. Multi-year, reseller and government procurement terms available on request.

Frequently asked

Post-quantum questions, answered plainly

PQC-SPM is a security platform category focused on discovering, monitoring, scoring and remediating cryptographic assets across an organisation's entire digital footprint. It moves enterprises off quantum-vulnerable classical algorithms — RSA, ECC and Diffie-Hellman — and onto the NIST-standardised post-quantum algorithms FIPS 203 ML-KEM, FIPS 204 ML-DSA and FIPS 205 SLH-DSA, so that Harvest Now, Decrypt Later attacks have nothing left to harvest.
Software Bill of Materials and Static Application Security Testing tools scan text files for known CVEs in software libraries. Next-Gen PQC-SPM provides dedicated cryptographic visibility across four layers: AST source code parsing, active network TLS socket probing, cloud KMS auditing and compiled binary inspection of ELF, PE, Mach-O and JAR files. It outputs native Cryptographic Bill of Materials payloads and evaluates mathematical primitives rather than just package versions.
A CBOM is a structured inventory of every cryptographic asset, algorithm, key size, digital certificate and cipher suite used across an application or an infrastructure estate. Next-Gen PQC-SPM exports CBOMs in the OWASP CycloneDX v1.7 international standard, which regulators and downstream security tooling can consume directly.
A CGO-free binary inspection engine parses compiled executable structures — Linux ELF, Windows PE, macOS Mach-O and Java archives. It reads symbol tables, dynamic linking headers and raw byte streams to identify embedded cryptographic libraries such as OpenSSL, BouncyCastle and mbedTLS, along with function imports and hardcoded PEM private key blocks, with no access to source required.
Yes. It runs as a single self-contained static binary with zero outbound network telemetry and no external SaaS dependency. It probes repositories, subnets and registries over read-only protocols — SSH, HTTPS and the Docker Registry V2 API — without installing permanent agents on production machines. It is safe to deploy inside classified SCIFs, air-gapped financial networks and critical national infrastructure.
The platform automates evidence for US OMB M-26-15 and M-23-02 federal CBOM inventory, NSA CNSA 2.0 adoption milestones from 2025 through 2035, PCI DSS v4.0.1 Requirement 12.3.3 cryptographic inventory for cardholder data environments, EU DORA Articles 8, 9 and 30 for financial sector ICT asset tracking, and the NIST IR 8547 algorithm deprecation timeline.
Under five minutes. There is no agent rollout, no collector fleet and no data pipeline to build — you point the binary at a repository, a subnet or a cloud account and it returns a scored CBOM in a single pass. Full enterprise coverage typically follows within the first week.

Ready to eliminate your enterprise quantum risk?

Full visibility into your cryptographic attack surface in under five minutes. Speak directly to the engineer who built the platform — no gatekeepers, no sales queue.

100% confidential · zero data shared · air-gapped deployment available

Prefer to write first? Contact the PITOWINGS team.