Cryptographic inventory, risk-based prioritization and migration engineering for federal agencies, contractors and healthcare.
OMB M-26-15
Oct 222026
Agency migration plans due to OMB
EO 14412
Dec 312030
Quantum-safe key exchange for high value systems
EO 14412
Dec 312031
Quantum-safe signatures for high value systems
What NIST proposes to retire
Source: NIST IR 8547, draft| Algorithm and use | Status | Replacement |
|---|---|---|
| RSA-2048Certificates, signing, key transport | Deprecated after 2030 | ML-DSA, ML-KEM |
| ECDSA P-256TLS certificates, tokens | Disallowed after 2035 | ML-DSA (FIPS 204) |
| X25519, ECDHTLS key exchange, VPNs | Disallowed after 2035 | ML-KEM (FIPS 203), hybrid first |
| AES-256Data at rest and in transit | Remains approved | No change |
RSA at 112-bit strength is proposed for deprecation after 2030; quantum-vulnerable public-key algorithms for disallowance after 2035.
Code, containers, network endpoints, cloud key stores and live Kubernetes traffic, merged into one CycloneDX cryptography bill of materials.
Ranked by data lifetime, exposure and migration effort, with a justification you can defend to OMB, your contracting officer or your auditor.
Hybrid key exchange, reissued certificates and dated milestones, with a reproducible run record behind every finding.
Every date below comes from EO 14412 and OMB M-26-15. The next one is highlighted.
| Date | Milestone | Status |
|---|---|---|
| EO 14412 signed | ||
| Agencies name a PQC migration lead | ||
| Agency migration plans due to OMB and ONCD | ||
| FAR proposed rule due on contractor FIPS and PQC compliance | ||
| CISA and NIST guidance on CBOM minimum elements due | ||
| PQC key establishment for HVAs and high impact systems | ||
| PQC digital signatures for HVAs and high impact systems |
Dates are computed from the deadlines in EO 14412 (signed June 22, 2026) and OMB M-26-15 (June 24, 2026). Rulemaking dates are deadlines to publish proposed rules.
Built in-house and tested against planted cryptography before every release. No third-party platform to license.
Source code, configuration, key and certificate files, and dependency manifests, merged into a CycloneDX cryptography bill of materials.
Protocol versions, certificates, and a direct test for quantum-safe X25519MLKEM768 key exchange on every in-scope endpoint.
eBPF sensors that record the handshakes your workloads actually negotiate.
Key specifications and certificates across AWS, Azure and Google Cloud key services.
Post-quantum support status for the products in your environment, with sources and dates.
Findings mapped to NIST, CMMC and HIPAA, with a reproducible run record behind each one.
Most scanners stop at source code. Much of the real exposure sits in runtime traffic, infrastructure and machine identities.
Most TLS tools cannot even offer the post-quantum hybrid group, so they cannot tell you whether a server supports it. We built our own handshake test for X25519MLKEM768 and run it on every endpoint in scope.
Code shows what could run. Our eBPF runtime observer will record every TLS handshake between workloads, including east-west traffic a perimeter scanner never sees.
mTLS certificates issued by Istio, Cilium and SPIFFE, which rarely appear in any inventory.
HL7 and FHIR endpoints, DICOM links, certificate-signed EDI exchanges, and medical devices that stay in service for a decade or more.
Certificate issuers, ingress TLS, admission webhooks and stored secrets.
RSA and elliptic-curve keys in managed key stores, and every issued certificate.
JWT and SAML signing keys, SSH host keys and code-signing certificates.
C, C++ and C#, where scanners are weakest. AI-assisted review on models inside the engagement environment, confirmed by an engineer.
Inventory, prioritization, vendor coordination and TLS 1.3 milestones for your OMB M-26-15 migration plan.
Readiness ahead of the FAR rule on FIPS and post-quantum compliance, plus NIST SP 800-171 gap assessments.
HIPAA security risk analysis, cryptographic inventory for long-lived patient data, and device crypto reviews.
Published prices, written scopes and no hourly surprises. Pay by card, ACH, government purchase card or purchase order.
Exposure checkFree
Public TLS endpoints and certificates on a domain you control, with a two-page summary.
Request a checkReadiness Snapshot$5,000
A cryptography bill of materials and ranked findings in one to two weeks. Credited in full toward an inventory.
Order a SnapshotInventory and planFrom $14,500
Full inventory and a migration plan covering all nine OMB M-26-15 elements.
Book a briefingWe help US federal agencies, their contractors and healthcare organizations move to quantum-safe cryptography and close the security gaps around it.
The same transition is under way in governments around the world. As standards take hold internationally, we bring the same tooling and method to public-sector partners abroad.
The people who scope your engagement run the tools, review the code and sign the findings.
Member
Cloud, AI and security infrastructure engineer with about a decade across federal, healthcare and large-scale cloud environments. Specializes in Kubernetes, eBPF and zero-trust networking, the kernel-level visibility behind our runtime analysis. Sets the technical approach behind our tooling and findings.
Hands-on engineer
Hands-on engineer who runs day-to-day operations, from engagement scheduling to delivery. Seasoned across front end and back end, he builds the reporting, interfaces and monitoring platform that turn scan results into evidence clients can act on.
We review your systems, frameworks and deadlines. You leave with a fixed quote.
Book a briefingSmall business. NAICS 541512, 541519, 541690. SAM.gov registration in progress.