Change detection

What is change detection?

Cryptographic change detection identifies when assets, configurations or dependencies appear, disappear or materially change after the initial inventory.

Post-quantum readiness is not a one-time scan. Buyers need to distinguish pipeline processing latency from the total time between a real target change and its discovery.

Questions to ask a vendor

1. What triggers a new observation?
2. How often are all authorized surfaces revisited?
3. Are change records signed, ordered and protected against deletion or reordering?

What this edition actually supports

Weight 3 of 19. Does the product record a meaningful before and after, with enough history to investigate drift?

A scheduled scan alone is not a verified change history. The edition scores public descriptions of repeated discovery, event history and traceable differences. QScout scores 8. Readers should distinguish vendor-described monitoring, an artifact-tested sequence and continuous customer deployment.

How to investigate this criterion

Ask for two dated inventories of the same scope, stable asset identity and a reviewable change event.

Primary and original inputs: pqc-index.org · pqc-index.org. Review all dated cell source checks and the 1 October per-cell limits.

The 2026.7 cells below are public-evidence scores. A vendor page documents a claim; an artifact check tests only its stated scope. Missing product execution and inaccessible sources remain explicit unknowns. The score snapshot has not been recomputed from later pages.