Question 1

Quantum is years away — why act now?

Accepted Answer

Harvest-now-decrypt-later means data encrypted today can be stored and decrypted after Q-Day. Mosca inequality (X + Y > Z) quantifies when that exposure requires action now — especially for banking and healthcare data with decades of shelf-life.

Question 2

We'll deal with it when standards settle.

Accepted Answer

FIPS 203/204/205 finalized in 2024. NSM-10, CMMC, and PCI-DSS 4.0 set migration clocks now. A baseline inventory is low-cost insurance while you plan the multi-year program.

Question 3

We can script our own TLS scans.

Accepted Answer

Scripts find endpoints. Qtangl adds Mosca HNDL scoring, framework mapping, drift diffs, signed PDFs, and independent verify links — the system of record auditors expect between audit cycles.

Question 4

Isn't this just open-source liboqs?

Accepted Answer

OQS provides primitives. Qtangl provides the assembled program: orchestration, CBOM export, compliance crosswalk, drift monitoring, and signed evidence. We build on OQS for handshake proof — we don't replace it.

Question 5

We're evaluating SandboxAQ / Big 4 consultants.

Accepted Answer

Strong options for enterprise programs. If you need a fast, verifiable baseline this quarter at mid-market price — with continuous drift — that's Qtangl. We partner with consultants for migration labor.

Question 6

Are you secure enough to hold our crypto inventory?

Accepted Answer

We sell to security teams and hold ourselves to the same standard. PQC scans are TLS/crypto inventory only — no application data. See our trust center for SOC 2 scope and self-scan posture.

Question 7

What if Qtangl disappears?

Accepted Answer

Your CBOM exports in open CycloneDX format. Inventory data is portable — no proprietary lock-in on the artifact itself.

Question 8

How accurate is the scan?

Accepted Answer

Transparent scope: inventory aid, not formal audit. Coverage confidence is shown on every report. You review findings, set remediation status, and re-scan to verify fixes.

Question 9

Will it find internal certs, not just external TLS?

Accepted Answer

External scanning plus PEM/K8s bundle upload and cloud inventory import (ACM, Key Vault) for internal-facing crypto.

Question 10

Monitor seems expensive vs a one-time assessment.

Accepted Answer

Compare to quarterly manual inventory plus audit prep — often $150K+/yr in loaded labor and consulting amortization. Monitor is continuous drift coverage with signed evidence each cycle.

Question 11

No budget this year.

Accepted Answer

Start with a one-time Assessment to build the internal case, or run the free demo scan to quantify exposure before procurement.

Honest answers for security buyers