---
title: "PQ Crypto Surface Scanner"
canonical: https://trickest.com/library/pq-crypto-surface-scanner
description: "Enumerate live hosts from a domain, fingerprint TLS and post-quantum readiness with AC Scanner, and emit CBOM-style evidence plus remediation."
---

# PQ Crypto Surface Scanner

## Overview

Harvest-now decrypt-later is already a planning problem for long-lived TLS. Operators need a crypto inventory of what their surface still speaks, where hybrid or classical-only stacks sit, and which hosts need remediation before PQC mandates land. The workflow takes hosts and returns TLS/PQC findings and CBOM-style rows, on a schedule you can retest.

This is a standing check for [exposure management](/use-cases/exposure-management). You point it at a domain you own (or feed a host list), run BHUSA 2026 Arsenal AC Scanner for TLS and post-quantum readiness signals, and get an evidence report with remediation hints and a retest delta when configs change.

It sits next to the library [Full Subdomain Enumeration](/library/full-subdomain-enumeration) (inventory without crypto posture). This Collection unit is the Arsenal PQ path: subfinder and httpx expand a target domain, extract-hosts builds the scan list, AC Scanner fingerprints TLS/PQC, and report emits findings, inventory, cbom, and retest_delta. Demo default is `cloudflare.com`.

## Pipeline

1. Seed · Target Domain(s) (`eof-raw-data`) supplies the target domain list (demo default `cloudflare.com`).
2. subfinder enumerates subdomains for those domains.
3. httpx probes for live hosts.
4. extract-hosts builds the host or host:port list for TLS scanning.
5. ac-scanner fingerprints TLS and post-quantum readiness on that list.
6. report turns the AC Scanner folder into findings, inventory, cbom, summary, and retest_delta outputs.

## Inputs

- **Target domain(s).** Edit Seed · Target Domain(s) (`eof-raw-data`) for the full enum path.
- **Host list (optional fast path).** One `host` or `host:port` per line into AC Scanner hosts (or replace extract-hosts output) when you already have inventory and want to skip enum.
- **AC Scanner.** Private vault tool. Point it at your host list.

## Outputs

- **findings.jsonl.** TLS/PQC findings with remediation hints.
- **inventory.jsonl.** Hosts observed in the run.
- **cbom.jsonl.** CBOM-style crypto component rows.
- **summary.jsonl.** Rollup for the report pass.
- **retest_delta.jsonl.** Schedule-as-diff scaffold when you re-run after TLS or cert changes.

## Integrations

- [subfinder](/tools/subfinder)
- [httpx](/tools/httpx)
- [ac-scanner](/tools/ac-scanner) (BHUSA 2026 Arsenal)

## Sample output

Sample shape from the report pack (illustrative, not a live KPI).

```jsonl
{"kind":"finding","title":"Classical-only TLS stack on host","remediation":"Plan hybrid or PQC-capable TLS where data lifetime requires it"}
{"kind":"cbom","component":"tls","note":"CBOM-style crypto component row for inventory"}
{"kind":"retest_delta","note":"Schedule re-runs to diff crypto posture when certs or edge configs change"}
```

## FAQ

### Is the default run safe to leave as-is?

The demo domain is `cloudflare.com` for a public shape check. For your estate, change Target Domain(s) to a domain you authorize, or feed your own host list. Do not point enum at third-party estates without authorization.

### Do I need quantum hardware to use this?

No. The workflow inventories TLS and post-quantum readiness signals on live hosts. It does not require quantum hardware on your side.

### Can I skip subdomain enum?

Yes. Build a host list and connect it to AC Scanner hosts (or replace extract-hosts). Use that when you already trust your inventory and want a faster TLS/PQC pass.

### Why schedule this?

Report emits `retest_delta.jsonl` so a scheduled re-run can surface posture change when certificates, ciphers, or edge configs land. Monthly or after major TLS rollouts is a sensible floor.

### Where is the AC Scanner tool page?

See [ac-scanner](/tools/ac-scanner). Upstream is QubitAC AC Scanner; on Trickest the node takes `--host` or `--hosts` and feeds the report stage.

## Related workflows

- [Full Subdomain Enumeration](/library/full-subdomain-enumeration). Reach for this instead when you need inventory first and are not ready for TLS/PQC posture.
- [Multi-Cloud Dangling DNS](/library/multi-cloud-dangling-dns). Reach for this instead when the job is dangling cloud DNS, not crypto inventory.

---
_Markdown source of https://trickest.com/library/pq-crypto-surface-scanner._