{
  "slug": "cryptonext-compass",
  "name": "CryptoNext COMPASS",
  "vendor": "CryptoNext Security",
  "researched_at": "2026-09-26",
  "product_status": {
    "summary": "COMPASS (Analytics + Network Probe, GA 1 July 2025) remains marketed under the same name. New since Aug 2026: 'CryptoNext Discovery On Demand', a two-week scoped assessment service announced Paris, 10 Sept 2026 (report prioritizes weak/quantum-vulnerable assets by severity and measures DORA/NIST gaps). It is a service offering, not a COMPASS feature release, and was not credited to COMPASS cells. A brand refresh is listed (undated on page). No rename or acquisition found.",
    "url": "https://www.cryptonext-security.com/wp-content/uploads/2026/09/20260910-PR_CryptoNext_Discovery_On_Demand-EN.pdf"
  },
  "cells": {
    "C1": {
      "score": 6,
      "anchor": "6: 3-4 surfaces",
      "urls": [
        "https://info.cryptonext-security.com/hubfs/Datasheet%20CryptoNext%20COMPASS%20Network%20Probe.pdf",
        "https://www.cryptonext-security.com/wp-content/uploads/2025/05/67eb83aa28108c0a38990ee7_20250401-CryptoNext-PR-COMPASS-Discovery-Launch-Announcement-VDEF.pdf",
        "https://www.cryptonext-security.com/en/products-cryptography-discovery-and-inventory/",
        "https://www.cryptonext-security.com/en/solutions-use-case-inventory-your-cryptography/"
      ],
      "quote": "Inspected Protocols TLS/SSL, DTLS, QUIC, SSH, ISAKMP, Kerberos, DNSSec, SMB",
      "rationale": "Native discovery is the passive network probe: (a) TLS/network, (b) certificates in transit, (i) SSH/IPsec/ISAKMP, (j) OT protocols (dnp3 etc.) = 4 surfaces with 'algorithms, parameters, keys, certificates' extraction. Other sources (CLM, scanners, EDRs) are third-party feeds via API, not COMPASS discovery; PQC/hybrid detection not documented in the URLs searched.",
      "delta_vs_published": 0
    },
    "C2": {
      "score": 6,
      "anchor": "6: standard-schema export documented, no integrity mechanism",
      "urls": [
        "https://info.cryptonext-security.com/hubfs/Datasheet%20CryptoNext%20COMPASS%20Network%20Probe.pdf"
      ],
      "quote": "The CryptoNext COMPASS Network Probe produces CBOM files, based on the OWASP CycloneDX standard, enabling easy integration with any system that supports this format.",
      "rationale": "CycloneDX CBOM output streamed via Kafka is documented; the datasheet's 'code signing' and 'software integrity checks' refer to the appliance, not to the CBOM artifact. CBOM signing/hash chain and a public sample are not documented in the URLs searched.",
      "delta_vs_published": -1
    },
    "C3": {
      "score": 5,
      "anchor": "midpoint between 4 (point-in-time scans) and 6 (scheduled rescans with documented diff/drift reporting)",
      "urls": [
        "https://info.cryptonext-security.com/hubfs/Datasheet%20CryptoNext%20COMPASS%20Network%20Probe.pdf",
        "https://www.cryptonext-security.com/en/products-cryptography-discovery-and-inventory/"
      ],
      "quote": "The CryptoNext COMPASS Network Probe is a hardware appliance designed for passive and continuous network traffic monitoring, enabling the detection and collection of cryptographic assets in transit to build a comprehensive inventory.",
      "rationale": "Continuous passive capture is documented (exceeds point-in-time), but diff/drift reporting, change alerts and tamper-evident change history are not documented in the URLs searched; published 8 requires drift alerts AND signed/hash-chained history.",
      "delta_vs_published": -3
    },
    "C4": {
      "score": 5,
      "anchor": "midpoint between 4 (vulnerable/not flag) and 6 (categorical risk levels plus context); capped per rubric line 19",
      "urls": [
        "https://www.cryptonext-security.com/en/products-cryptography-discovery-and-inventory/",
        "https://www.cryptonext-security.com/en/solutions-use-case-inventory-your-cryptography/"
      ],
      "quote": "COMPASS does more than identify cryptographic assets: it links them to the data they protect, with information on sensitivity and criticality, to enable risk-based prioritization.",
      "rationale": "Detection of weak/non-compliant algorithms plus a claimed sensitivity/criticality context for prioritization; no score, categories, formula or HNDL/data-lifetime factor documented, so the claim is capped below the anchor it implies.",
      "delta_vs_published": -1
    },
    "C5": {
      "score": 0,
      "anchor": "0: not documented",
      "urls": [
        "https://info.cryptonext-security.com/hubfs/Datasheet%20CryptoNext%20COMPASS%20Network%20Probe.pdf",
        "https://www.cryptonext-security.com/wp-content/uploads/2025/05/67eb83aa28108c0a38990ee7_20250401-CryptoNext-PR-COMPASS-Discovery-Launch-Announcement-VDEF.pdf",
        "https://www.cryptonext-security.com/en/products-cryptography-discovery-and-inventory/",
        "https://www.cryptonext-security.com/en/solutions-use-case-inventory-your-cryptography/",
        "https://www.cryptonext-security.com/en/blog/cryptonext-security-launches-cryptonext-compass-discovery-the-first-truly-open-cryptographic-assets-discovery-and-analysis-solution/",
        "web search 2026-09-26: site:cryptonext-security.com COMPASS \"false positive\" OR accuracy OR precision OR benchmark (no vendor hits)"
      ],
      "quote": "not documented in the URLs listed (no accuracy metric, benchmark, test methodology or false-positive handling found)",
      "rationale": "Throughput ('up to 1 Gbps') and 'no packets lost' are performance claims, not detection-correctness metrics.",
      "delta_vs_published": -5
    },
    "C6": {
      "score": 4,
      "anchor": "4: remediation guidance only (downstream export to CMDB/CTEM named; no ticketing documented)",
      "urls": [
        "https://www.cryptonext-security.com/wp-content/uploads/2025/05/67eb83aa28108c0a38990ee7_20250401-CryptoNext-PR-COMPASS-Discovery-Launch-Announcement-VDEF.pdf",
        "https://www.cryptonext-security.com/en/products-cryptography-discovery-and-inventory/"
      ],
      "quote": "Standard APIs for easy upstream (sensors: CLM, scanners, EDRs, etc.) and downstream (platforms: CMDB, CTEM, etc.) integrations",
      "rationale": "Downstream API export named; ticket creation, automated remediation or closure verification not documented in the URLs searched. CryptoNext 'Remediation' SDK is a separate product and not credited to COMPASS.",
      "delta_vs_published": 0
    },
    "C7": {
      "score": 6,
      "anchor": "6: dashboards plus exports (compliance reports named without documented mapping, capped per rubric line 19)",
      "urls": [
        "https://www.cryptonext-security.com/en/products-cryptography-discovery-and-inventory/",
        "https://www.cryptonext-security.com/wp-content/uploads/2025/05/67eb83aa28108c0a38990ee7_20250401-CryptoNext-PR-COMPASS-Discovery-Launch-Announcement-VDEF.pdf",
        "https://info.cryptonext-security.com/hubfs/Datasheet%20CryptoNext%20COMPASS%20Network%20Probe.pdf"
      ],
      "quote": "Use ready-made compliance reports, customize them, and respond to audits at any time.",
      "rationale": "Dashboards, a 'personalized report generation module', REST API and CBOM/Kafka export are documented; compliance reports and DORA/NIS2/ANSSI/NIST references are named but no report content, framework mapping or sample is documented.",
      "delta_vs_published": -1
    }
  },
  "total": 4.84,
  "published_total": 6.26,
  "urls_that_failed": [],
  "notes": "Primary evidence is thin: one hardware datasheet (PDF, text read directly), one launch press release (PDF on vendor site; used only for concrete capability statements), and two marketing product pages. No public docs portal, GitHub repo or sample CBOM was found. The WebFetch PDF parse failed; both PDFs were downloaded by the fetch tool and read page-by-page, so datasheet quotes are verbatim. Published C3=8 is the largest unsupported cell: nothing fetched documents drift alerts or tamper-evident history. Between-anchor convention: integer midpoint, both anchors named. Third-party descriptions (encryptionconsulting.com, postquantum.com) claiming '100+ protocols' and endpoint/code-scanner correlation are inadmissible and were not credited. The 10 Sept 2026 Discovery On Demand release (read verbatim from the PDF) describes a consulting-style service report with severity prioritization and DORA gap measurement; a reviewer could argue it lifts C4/C7 if the service is treated as part of COMPASS, but the release does not name COMPASS, so it was not credited."
}