loading
Enumerate live hosts from a domain, fingerprint TLS and post-quantum readiness with AC Scanner, and emit CBOM-style evidence plus remediation.
Subdomains are found, live hosts are probed, then each host's TLS is checked for post-quantum readiness.
A domain. One per line. Default cloudflare.com.
TLS and post-quantum findings, a CBOM-style inventory, and report.json.
Harvest-now decrypt-later is already a planning problem for long-lived TLS. Operators need a crypto inventory of what their surface still speaks, where hybrid or classical-only stacks sit, and which hosts need remediation before PQC mandates land. Vendor blogs own the policy argument. This page owns the job: hosts in, TLS/PQC findings and CBOM-style rows out, on a schedule you can retest.
This is a standing check for exposure management. You point it at a domain you own (or feed a host list), run BHUSA 2026 Arsenal AC Scanner for TLS and post-quantum readiness signals, and get an evidence report with remediation hints and a retest delta when configs change.
It sits next to the library Full Subdomain Enumeration (inventory without crypto posture). This Collection unit is the Arsenal PQ path: subfinder and httpx expand a target domain, extract-hosts builds the scan list, AC Scanner fingerprints TLS/PQC, and report emits findings, inventory, cbom, and retest_delta. Demo default is cloudflare.com.
eof-raw-data) supplies the target domain list (demo default cloudflare.com).eof-raw-data) for the full enum path.host or host:port per line into AC Scanner hosts (or replace extract-hosts output) when you already have inventory and want to skip enum.Sample shape from the report pack (illustrative, not a live KPI).
| kind | title | remediation | component | note |
|---|---|---|---|---|
| finding | Classical-only TLS stack on host | Plan hybrid or PQC-capable TLS where data lifetime requires it | null | null |
| cbom | null | null | tls | CBOM-style crypto component row for inventory |
| retest_delta | null | null | null | Schedule re-runs to diff crypto posture when certs or edge configs change |
The demo domain is cloudflare.com for a public shape check. For your estate, change Target Domain(s) to a domain you authorize, or feed your own host list. Do not point enum at third-party estates without authorization.
No. The workflow inventories TLS and post-quantum readiness signals on live hosts. It does not require quantum hardware on your side.
Yes. Build a host list and connect it to AC Scanner hosts (or replace extract-hosts). Use that when you already trust your inventory and want a faster TLS/PQC pass.
Report emits retest_delta.jsonl so a scheduled re-run can surface posture change when certificates, ciphers, or edge configs land. Monthly or after major TLS rollouts is a sensible floor.
See ac-scanner. Upstream is QubitAC AC Scanner; on Trickest the node takes --host or --hosts and feeds the report stage.
Get a personalized demo
A 30-minute walkthrough. We map the platform to your stack and answer pricing and deployment questions for your environment.