Category analysis
The most useful conclusions are not small differences in rank. They are the recurring evidence, accuracy and remediation gaps across the market.
Across the fourteen scored products, one publishes per-detector figures for its own product and one open-source toolchain has been independently benchmarked. The rest ask buyers to act on inventories without a published error rate. S23S26
Most products emit a CycloneDX bill of materials. Two are documented as producing a cryptographically verifiable record, and one publishes a key and a procedure a stranger can use without contacting the vendor. S02S05
Discovery breadth has the highest field mean. The meaningful separation now appears in evidence integrity, change handling, risk quantification and remediation after an inventory exists.
Capability leadership and certification or deployment assurance rarely sit in the same company, forcing buyers to evaluate technical performance and vendor approval as separate decisions. S11S12S13
AppViewX and Keyfactor document bidirectional workflow and certificate lifecycle capabilities that QScout does not yet demonstrate against a live ticketing tenant. S24S25
Remediation loop, 8/10. The inbound path exists in code, but the report says it has not completed a round trip against a live ticketing tenant. This rests on code presence, not observed tenant behaviour. S03
Change detection, 9/10. Nine of fourteen materialized events were signed and hash-chained. The reported two-to-three-millisecond value is pipeline materialization time, not the delay between a target change and discovery. The observed window is roughly 52 minutes against a 24-hour target. S02
Correctness, 8/10. The published 1,368-case corpus reports recall of 0.7628, below the QScout.s own integration floor. Labels were not independently human-annotated. S02S23
Assurance, not scored. The report states that Qtonic Quantum Corp has no company-held product certification; infrastructure-provider certifications are inherited controls, not Qtonic attestations. S01
These exclusivity claims were previously made by Qtonic Quantum Corp and are contradicted by competitor evidence. Keeping them visible is part of the correction record.
| Withdrawn claim | Correction | Sources |
|---|---|---|
| Only product emitting CycloneDX 1.7 | CBOM Secure and another listed scanner document CycloneDX 1.7 output. | S06S20 |
| Only tamper-evident cryptographic history | CBOM Secure documents a cryptographically verifiable asset-change log. | S05 |
| Only per-finding reachability model | CBOM Secure documents cross-file call-graph reachability. | S04 |
| Only quantitative harvest-now-decrypt-later model | CBOM Secure and O3 Security both document quantitative prioritization models. | S05S17 |