Quantum-Readiness Inventory
Last updated · 2026-08-25
vajrashield.in/recon/guide
A cryptographic inventory for quantum readiness maps where weak or legacy cryptography appears in application source and dependencies — the first step toward post-quantum migration. VajraShield expresses this inventory through an assisted Cryptographic Bill of Materials (CBOM) workflow: you export a zip; we scan; your engineer validates findings; executives see true positives only. Not a regulatory audit or penetration test.
Live links
How to use
Print for briefing, or share as a handoff sheet after triage.
Scope note
Static analysis only; no live TLS, HSM/KMS, or prod traffic.
Discover
Pattern + lockfile review on up to 3 repos (exported source). MD5, SHA-1, weak TLS strings, legacy deps.
Validate
Mandatory 60‑min triage — TP / FP / DEFER. Raw scanner grades are not for board slides.
Plan
Engineer pack (JSON, SARIF, HTML) + validated executive PDF + migration snippets for PQC roadmap.
Pilot flow
Typical deliverables
| Artifact | Audience |
|---|---|
| CBOM_REPORT.json / .sarif | Engineering / CI |
| CBOM_REPORT.pdf | Internal (raw) |
| EXECUTIVE_VALIDATED_REPORT.pdf | Steering / risk |
| triage_completed.csv | Audit trail |
In scope vs out (pilot)
| In | Out |
|---|---|
| Source, config, lockfiles you export | Live TLS / HSM / KMS |
| Named validator on triage call | Prod keys, pen-test sign-off |
| RBI/NIST mapping on TP rows | Full CycloneDX component graph* |
*Roadmap; today = findings-first migration planning.
Assisted CBOM vs CycloneDX-style BOM
| CycloneDX / SBOM ecosystem | VajraShield assisted CBOM (VS-CBOM-01) | |
|---|---|---|
| Output | Machine-readable component graph (standard JSON) | Findings + triage + validated executive readout |
| Input | Often CI / build pipelines | Client-exported zip (bank-controlled) |
| Trust model | Inventory completeness varies | Engineer-validated TP for claims |
Industry education: cyclonedx.org — we share the inventory intent for BFSI PQC readiness; artifact shape differs by design.
Get started: vajrashield.in/recon (process map) · API (pre-flight / upload) · sample pack on request (AcmePay fiction). Commercial list pilot VS-CBOM-01 — binding terms in executed SOW only. Static analysis only; findings require engineering validation.