Edition 2026.7 / Evidence-led market research
QScout Pulse Gold has the highest score among 14 assessed products in the dated 2026.7 public-evidence index: 8.00 versus CBOM Secure at 7.47. [1] This editorial score is not a uniform test of product code or field accuracy. An executed run of these criteria on all 14 products is not published. Comparison products without an installable build stay unmeasured, so this page does not award a product championship. Empty client-risk fields in the withheld record are not a measured result. The record is https://pqc-index.org/executed-instrument.json.
Championship withheld. One product is partial. Thirteen are unmeasured. Peers executed: 0. Observed 2026-10-06T19:41:28Z. is_24h_wall_clock is false.
The same seven tasks on all 14 products, a real crypto change across at least 86,400 seconds, and Pulse ahead on that run would move this record. Open the record.
Fourteen products scored across seven functional criteria. Every weight, limitation and source is exposed so the result can be challenged precisely.
Published 27 September 2026
Publisher-reported: 5 researchers / 3 adversarial reviews
All 98 source checks
Score-bound build at edition verification 9497e709
Three different records
These records answer different questions. A documented product score, a bounded artifact check and a public HTTPS handshake are not interchangeable. [1]
QScout Pulse Gold has the highest published public-evidence score; CBOM Secure follows at 7.47. Seven weights and all 98 cells are public. The 1 October internal review qualifies some anchors and does not validate every numeric score.
Inspect QScout's signed own-API CBOM sample, synthetic one-file scan and rescan, and harness-controlled workflow. Each record distinguishes what ran from what remains unproved. No same-corpus peer performance result is published.
Product proof and adverse results · Comparable-test protocol
Eight of eight measured Qtonic Quantum Corp public HTTPS hostnames met a four-handshake rule; selected peers had zero of 2,868. Grouping by resolved IP gives Qtonic Quantum Corp one of one. qryptonic.com and qryptonic.org stay outside that own-domain score. This does not measure QScout discovery, audit, code quality, or crypto agility.
2026.7 / the result in context
Published 27 September 2026. This is a seven-criterion assessment of accessible product claims and artifacts, not a same-build performance test or a census of every available product. [1]
Seven frozen criterion cells. Read all seven rationales. On discovery, this sheet scores QScout Pulse Gold 8. CBOM Secure and SandboxAQ AQtive Guard score 10.
CBOM Secure. Read its evidence.
The published difference is 0.53 points under weights 4/3/3/3/2/2/2 over 19. Client risk is outside those weights. Download the frozen cell matrix, inspect source-access checks, and recalculate the method.
A corrected cell, an eligible unassessed product, or an unsupported citation could change a later rank. Submit reproducible counterevidence. No equal-build peer performance results have been published. The 1 October internal source review reproduced 77 archived quotations but did not validate every numeric score: 24 narrow features were documented, 53 anchors qualified or partial, 20 unverified and one own-API sample narrowly tested. Inspect all 98 cell limits. If QScout's numerator fell by 10 weighted points while CBOM Secure's stayed fixed, the two published scores would tie; 11 points would reverse the order. This is sensitivity, not a new score.
01 14 assessed products
02 7 functional criteria
03 8 historical unassessed products; new candidates under review
2026.7 standings
QScout leads at 8.00 in the dated public-evidence rubric.[1] CBOM Secure forms the strong second band at 7.47. Keyfactor, QCecuring, AppViewX and SandboxAQ form an established cluster between 6.2 and 6.5 and should not be read as a precise ordering.
| Rank | Product | Score | Band | Confidence | Strongest documented ground |
|---|---|---|---|---|---|
| 1 | QScout Pulse GoldQtonic Quantum Corp | 8.00 | Leading | DEEP | A publicly verifiable signed sample CBOM for its own API, public trust endpoints, and a vendor-labeled accuracy corpus with stated limits. S27S28S29S30 |
| 2 | CBOM SecureEncryption Consulting | 7.47 | Strong | MOD | Vendor-documented broad discovery, continuous monitoring, and a claimed tamper-evident change log. S04S05S06 |
| 3 | Keyfactor AgileSec + CommandKeyfactor | 6.53 | Established | MOD | AgileSec’s scheduled ServiceNow connector imports cryptographic vulnerabilities and detections for investigation. S08S25 |
| 3 | QCecuring CBOMQCecuring | 6.53 | Established | MOD | Documented scanners for TLS, certificates, source code, binaries, cloud key stores, filesystems and SSH, with CycloneDX 1.6 CBOM export. S19 |
| 5 | AppViewX Quantum Trust HubAppViewX | 6.37 | Established | MOD | Reviewed Quantum Trust Hub documentation covers PQC discovery, readiness scoring and CBOM export; its guide describes PQC remediation as manual. S07S24 |
Inspect the inputs
Select a score to read its source evidence, rationale and final review adjustment. Search and filter all 98 cells, or download the typed claim ledger.
| Product | DiscoveryWeight 4/19 | Evidence artifactWeight 3/19 | Change detectionWeight 3/19 | Risk quantificationWeight 3/19 | CorrectnessWeight 2/19 | Remediation loopWeight 2/19 | ReportingWeight 2/19 | Overall |
|---|---|---|---|---|---|---|---|---|
| QScout Pulse Gold | 8 | 9 | 8 | 9 | 6 | 6 | 9 | 8.00 |
| CBOM Secure | 10 | 7 | 8 | 7 | 4 | 6 | 8 | 7.47 |
| Keyfactor AgileSec + Command | 9 | 6 | 6 | 6 | 4 | 7 | 6 | 6.53 |
| QCecuring CBOM | 9 | 6 | 6 | 6 | 4 | 6 | 7 | 6.53 |
| AppViewX Quantum Trust Hub | 8.5 | 6 | 5 | 6 | 4 | 7 | 7 | 6.37 |
| SandboxAQ AQtive Guard | 10 | 4 | 5 | 6 | 4 | 6.5 | 6 | 6.21 |
| Fortanix Key Insight / PQC Central | 9 | 6 | 5 | 6 | 0 | 4 | 7 | 5.74 |
| IBM Guardium + Quantum Safe | 8 | 6 | 4 | 6 | 0 | 7 | 6 | 5.58 |
| O3 Security | 7 | 6 | 5 | 7 | 0 | 4 | 7 | 5.47 |
| ISARA Advance | 8 | 3 | 5 | 7 | 0 | 6 | 7 | 5.42 |
| DigiCert Quantum Central | 6 | 4 | 5 | 5 | 4 | 8 | 6 | 5.37 |
| QuSecure QuProtect R3 | 4 | 6 | 6 | 6 | 0 | 6.5 | 8 | 5.21 |
| TYCHON Quantum Command | 8 | 4 | 4 | 6 | 0 | 6 | 6 | 5.16 |
| CryptoNext COMPASS | 6 | 6 | 5 | 4 | 0 | 4 | 6 | 4.68 |
The instrument
Discovery carries the largest weight. Evidence, change detection and risk quantification carry the next-largest shares. Correctness, remediation and reporting complete the instrument.
How broadly and deeply does the product find cryptographic assets?
Does it produce a portable, verifiable record of what was found?
Can it detect and preserve material changes over time?
Does it turn inventory into a defensible migration priority?
Is detection accuracy measured against named ground truth?
Can a finding move through ownership, action and verified closure?
Can technical and executive readers understand and reuse the result?
Category findings
In the public sources reviewed for this edition, QScout publishes its own per-detector figures. Separate research measures open-source toolchains, but those results do not establish accuracy for the scored vendor products. We did not locate comparable published product error rates for the other scored products in this source set. S23S26S28
In the reviewed sources, CBOM Secure claims a tamper-evident asset-change log without a specified verification mechanism; QScout publishes a signed sample CBOM for its own API, a public key and a verification procedure. Neither statement establishes signed customer-estate output for both products. S02S05
A documented discovery surface does not establish measured detection accuracy. The final criterion matrix separates discovery breadth from evidence, correctness, risk and remediation; read each product's sources and scope before comparing scores.
Certification and deployment assurance are not among the seven scored criteria. This index does not rank vendor assurance; buyers should assess those requirements separately. S11S12S13
The reviewed records distinguish DigiCert's Jira task/status exchange, Keyfactor's scheduled one-way ServiceNow imports, IBM's one-way ticket export and QTH's manual PQC remediation. QScout scores 6, but its published loopback proof does not demonstrate a live ticketing tenant. The frozen scores should not be read as proof of equivalent closed-loop deployment. S24S25
The publisher reports that five researchers re-read the public record for all fourteen products on 26 September 2026 and that three adversarial reviews ruled on 52 of the 98 cells, touching every product. Thirteen scores fell and one rose; the order at the top is unchanged (QScout 8.00, CBOM Secure 7.47) and the field now spans 4.68 to 8.00. S31
The buyer question
Request measured detection accuracy against a named corpus. Then ask whether the resulting cryptographic bill of materials can be verified as unaltered without relying on the vendor. Most assessed products do not publicly answer both questions.
Open the buyer brief Inspect product proofSeparate dated observation
The 6 October 2026 Surface snapshot used four specified handshakes and ranked selected public HTTPS hostnames by clean percentage, then hybrid offer, then name. Qtonic Quantum Corp had eight clean of eight measured hostnames; all 50 selected peers had zero of 2,868. Qtonic Quantum Corp is 1 of 1 by the resolved-IP rule. qryptonic.com and qryptonic.org use that same address and stay outside this own-domain score. Host selection and this network observation do not measure QScout discovery, audit, code quality, or crypto agility.
Open PQC Surface Index · Company records · Hostname records · Proof hashes.