Post-Quantum Discovery Capability Index 2026.5

Q: What is post-quantum cryptographic discovery?

It is the process of finding cryptographic assets, protocols, certificates, keys and dependencies that may need migration before quantum-capable attacks become practical.

Q: Which post-quantum discovery product ranks first in edition 2026.5?

QScout Pulse Gold ranks first at 9.42. Qtonic Quantum Corp, its maker, sponsored and contributed the original evidence work, and the QScout evidence was tested more deeply than peer evidence. The index discloses that asymmetry.

Q: Is the PQC Discovery Index independent?

PQC Discovery Index Research is the standalone website publisher. Qtonic Quantum Corp sponsored and contributed the original evidence work and makes the top-scored product, so the publication discloses that conflict and does not claim organizational independence.

PQC Discovery Index Research

Edition 2026.5 / Evidence-led market research

Which post-quantum discovery tools can prove what they find?

Fourteen products scored across seven functional criteria. Every weight, limitation and source is exposed so the result can be challenged precisely.

Explore the ranking Audit the method

Capability index2026.5

Products scored: 14
Functional criteria: 7
Probes per product: 56
Method version: v2026.08.12

Published 15 August 2026
Score-bound build 8b656ac6

01 Finding is largely solved

02 Proving remains rare

03 Remediation separates the field

2026.5 standings

The leading capability band

QScout leads the disclosed instrument. CBOM Secure forms the strong second band. AppViewX, IBM and Keyfactor should be read as an established cluster, not as precise second-decimal ordering.

Rank	Product	Score	Band	Confidence	Strongest documented ground
1	QScout Pulse GoldQtonic Quantum Corp	9.42	Leading	DEEP	Signed inventory verifiable by a stranger, published detector accuracy and a published vantage policy. S01 S02 S03
2	CBOM SecureEncryption Consulting	8.21	Strong	MOD	The widest documented discovery surface, continuous policy evaluation and a cryptographically verifiable change log. S04 S05 S06
3	AppViewX Quantum Trust HubAppViewX	7.58	Established	MOD	Bidirectional ServiceNow control, closed-loop certificate lifecycle automation and remediation inside delivery pipelines. S07 S24
4	IBM Guardium + Quantum SafeIBM	7.39	Established	MOD	IBM authored the CBOM specification, and its open-source toolchain has been benchmarked against external ground truth. S09 S10 S23
5	Keyfactor AgileSec + CommandKeyfactor	7.37	Established	MOD	ServiceNow applications route cryptographic findings into vulnerability response and automate certificate deployment to endpoint stores. S08 S25

See all 14 scores and criterion breakdowns

The instrument

Seven questions behind every score

Discovery carries the largest weight. Evidence, change detection and risk quantification carry the next-largest shares. Correctness, remediation and reporting complete the instrument.

C121.05%

Discovery

How broadly and deeply does the product find cryptographic assets?

C215.79%

Evidence artifact

Does it produce a portable, verifiable record of what was found?

C315.79%

Change detection

Can it detect and preserve material changes over time?

C415.79%

Risk quantification

Does it turn inventory into a defensible migration priority?

C510.53%

Correctness

Is detection accuracy measured against named ground truth?

C610.53%

Remediation loop

Can a finding move through ownership, action and verified closure?

C710.53%

Reporting

Can technical and executive readers understand and reuse the result?

Category findings

What the ranking says about the market

F-01

Accuracy is measured in the literature and almost never published by vendors

Across the fourteen scored products, one publishes per-detector figures for its own product and one open-source toolchain has been independently benchmarked. The rest ask buyers to act on inventories without a published error rate. S23 S26

F-02

Signing the evidence remains rare

Most products emit a CycloneDX bill of materials. Two are documented as producing a cryptographically verifiable record, and one publishes a key and a procedure a stranger can use without contacting the vendor. S02 S05

F-03

Discovery has converged; downstream execution has not

Discovery breadth has the highest field mean. The meaningful separation now appears in evidence integrity, change handling, risk quantification and remediation after an inventory exists.

F-04

The best functional products and the best-assured vendors differ

Capability leadership and certification or deployment assurance rarely sit in the same company, forcing buyers to evaluate technical performance and vendor approval as separate decisions. S11 S12 S13

F-05

Remediation is the criterion where QScout does not lead

AppViewX and Keyfactor document bidirectional workflow and certificate lifecycle capabilities that QScout does not yet demonstrate against a live ticketing tenant. S24 S25

Read findings, limitations and withdrawn claims

The buyer question

Do not ask only what a scanner finds. Ask what a stranger can verify.

Request measured detection accuracy against a named corpus. Then ask whether the resulting cryptographic bill of materials can be verified as unaltered without relying on the vendor. Most assessed products do not publicly answer both questions.

Use the evaluation framework