Formats consumed and emitted
| Format | Direction | Support |
|---|---|---|
| SARIF 2.1.0 | Emitted | --format sarif, with security-severity, tags, per-rule help, stable fingerprints — plus report jobs |
| CycloneDX (SBOM in) | Consumed | Full SBOM ingest, plus manifest analysis |
| SPDX | Consumed | Yes |
| CycloneDX 1.6 (CBOM out) | Emitted | Deterministic, per project |
| OCSF | Emitted | The SIEM export normalization |
| OpenTelemetry | Both | Export out, OTLP traces in for runtime correlation |
| JSON Schema 2020-12 | Emitted | The finding contract |
| OIDC / SAML 2.0 / SCIM 2.0 | Consumed | Yes |
What RelixQ names as a migration target
A generic scanner tells you an algorithm is weak. RelixQ goes one step further and carries a concrete replacement on the finding itself, so the output is a migration backlog rather than a list of complaints.
| What the finding says | How it is carried | |
|---|---|---|
Quantum-safety classification — vulnerable, classically_broken, grover_weakened, hybrid, quantum_safe, unknown | On every finding | |
| A named NIST replacement primitive — ML-KEM (FIPS 203), ML-DSA (FIPS 204), SLH-DSA (FIPS 205) | A structured migrationTarget field, plus hybrid guidance and vertical context from the curated Rule Pack | |
| Hybrid transition posture — whether a TLS endpoint already negotiates a post-quantum hybrid group | relixq scan tls reports certificate and protocol posture | Endpoint posture, the no_pqc_hybrid issue, and the PQC Compatibility Lab |
| Migration order — what to fix first, and what it unblocks | The Crypto-Agility Scorecard (how expensive the change is) | Score drivers, next-best actions, and blast-radius ranking over the readiness graph |
Mapping a mandate requirement to a RelixQ artifact
Most post-quantum mandates ask for the same handful of things in different words: an inventory, an assessment, a plan, evidence of decisions, and evidence that controls keep operating. This table maps those recurring requirements to the artifact that satisfies them and where to get it. The deadlines themselves — CNSA 2.0, NIST IR 8547, BSI, NIS2, DORA — are covered in Post-quantum concepts.
| Requirement | What RelixQ gives you | Where |
|---|---|---|
| A cryptographic inventory | A deduplicated CycloneDX CBOM with per-component evidence, deterministic so you can hash and diff it across releases | Enterprise — Inventory and CBOM |
| Identify quantum-vulnerable algorithms and key sizes | Algorithm-aware findings with key size, usage, and a quantum-safety classification on each one | Detection coverage |
| Demonstrate crypto-agility | The Crypto-Agility Scorecard, a 0–100 measure of how mechanically expensive an algorithm swap is | The scorecard API |
| A prioritized migration plan | Ranked score drivers, next-best actions with estimated uplift, blast-radius ordering, and the PQC readiness breakdown | Enterprise — RelixQ Score |
| A risk assessment of what is actually exposed | The QAST assessment report — HNDL exposure register, dated Mosca windows, attack paths, and retest status, in an Auditor lens | Enterprise — QAST |
| Evidence of risk-acceptance decisions | TTL-bounded exceptions with named approvers and expiry, on a verifiable hash-chained audit trail | Enterprise — Governance |
| Evidence that a control keeps operating | Scheduled scans, release-gate decisions with their conditions, and a CI gate evidence bundle per run | Release gates |
| Transport and certificate posture | TLS versions, cipher suites, certificate key and signature algorithms, expiry windows, and PQC hybrid support | relixq scan tls; TLS posture |
| Feed findings into existing GRC or SIEM tooling | SARIF 2.1.0 per scan; OCSF-normalized security findings streamed to your SIEM | Integrations |
Why the honesty stance matters for audit
Every generated Enterprise report — PDF included — passes an honesty lint before it renders. If generation would ever produce text claiming a decryption or an executed exploit, the job fails rather than ship the claim.
That constraint is what makes the output usable as evidence. Every finding carries an exploitability label — proven, modeled, or theoretical — with a rationale. Break proofs cite their verifier command and their published cost estimates. Mosca verdicts are dated and carry a contested-Z marker. An auditor can tell exactly which claims rest on executed evidence and which rest on a labeled model.
Related pages
Post-quantum concepts
The cryptography and threat model RelixQ is built on: what Shor and Grover break, why harvest-now-decrypt-later is a present-day problem, the Mosca inequality, and the NIST algorithms that replace what breaks.
Crypto asset inventory and CBOM export
How observations from every scanner dedupe onto canonical crypto assets, what the evidence ledger records, and how to export a deterministic CycloneDX Cryptographic Bill of Materials.
Governance, policies and exceptions
The policy engine that renders release-gate decisions, the TTL-bounded exception workflow, and the tamper-evident audit chain that makes both defensible to an auditor.
Glossary
Every term the products use — quantum concepts, NIST algorithms, RelixQ constructs, formats, and platform mechanics — defined precisely, with the product each applies to.