What AutoPQC actually does
Cryptographic discovery for supported inputs today, with mapping, prioritisation and performance evaluation on the roadmap
On this page — 4 sections
AutoPQC starts with a question an engineering team can investigate: where is cryptography declared in the inputs we can inspect? The current product scope is Discovery. This page separates that scope from the development roadmap.
Discovery today
The current Discovery Engine reads supported Java, Python, C#, Kotlin, Go and JavaScript/TypeScript source and dependency manifests, certificate and key files on disk, and TLS settings written in code. Findings carry evidence; unresolved algorithms are reported as unknown. Live TLS endpoints and wider infrastructure discovery are planned.
- Inspect the supported input types and agree the boundaries before a scan. An excluded system is not a clean result.
- Review the evidence attached to a finding before making a change. An unknown algorithm needs investigation.
- Use the CycloneDX cryptographic inventory to document observations from the supported inputs. It is not a claim that every asset in an enterprise has been found.
The roadmap
Mapping, prioritisation and performance evaluation are planned modules. The published scoring method explains an approach; it does not establish the availability of automated scoring, integrations. Console: Announced (roadmap).
| Module | Status | Intended purpose |
|---|---|---|
| Discovery | Current documented scope | Inspect supported inputs and produce an inventory with evidence. |
| Mapping | Planned | Relate findings to post-quantum successors by cryptographic role. |
| Prioritisation | Planned | Order migration work with reasons for each recommendation. |
| Performance evaluation | Planned | Compare classical and post-quantum performance on representative workloads. |
How to read the examples
This is a synthetic reference estate, not customer data or a measured pilot result. Its 42 assets and score of 75/100 illustrate the published method; they do not predict findings or accuracy on your systems.
The earlier classifier evaluation was synthetic. It does not establish customer accuracy, completeness or a speed advantage. The reproducibility guide explains what evidence a performance claim would require.
Boundaries
- Discovery is not decryption, exploitation or proof that an asset can be attacked today.
- An inventory does not certify compliance or approve a production change.
- Roadmap descriptions are not available deliverables. Confirm access, scope and commercial terms with the team.