Category analysis
The most useful conclusions are not small differences in rank. They are the recurring evidence, accuracy and remediation gaps across the market.
In the public sources reviewed for this edition, QScout publishes its own per-detector figures. Separate research measures open-source toolchains, but those results do not establish accuracy for the scored vendor products. We did not locate comparable published product error rates for the other scored products in this source set. S23S26S28
In the reviewed sources, CBOM Secure claims a tamper-evident asset-change log without a specified verification mechanism; QScout publishes a signed sample CBOM for its own API, a public key and a verification procedure. Neither statement establishes signed customer-estate output for both products. S02S05
A documented discovery surface does not establish measured detection accuracy. The final criterion matrix separates discovery breadth from evidence, correctness, risk and remediation; read each product's sources and scope before comparing scores.
Certification and deployment assurance are not among the seven scored criteria. This index does not rank vendor assurance; buyers should assess those requirements separately. S11S12S13
The reviewed records distinguish DigiCert's Jira task/status exchange, Keyfactor's scheduled one-way ServiceNow imports, IBM's one-way ticket export and QTH's manual PQC remediation. QScout scores 6, but its published loopback proof does not demonstrate a live ticketing tenant. The frozen scores should not be read as proof of equivalent closed-loop deployment. S24S25
The publisher reports that five researchers re-read the public record for all fourteen products on 26 September 2026 and that three adversarial reviews ruled on 52 of the 98 cells, touching every product. Thirteen scores fell and one rose; the order at the top is unchanged (QScout 8.00, CBOM Secure 7.47) and the field now spans 4.68 to 8.00. S31
Remediation loop, 6/10. The inbound HMAC receipt and the conflict-reopen rule are implemented, but no live ticketing tenant is demonstrated: every published proof runs against a loopback mock, and the public statements describe the write-back client as not deployed. S29
Change detection, 8/10. The public change window holds hourly folds of Qtonic Quantum Corp's own estate, signed and hash-chained. A real two-minute TLS monitor exists, but at verification its change events were not in the signed journal, the published drift latency measured pipeline write time rather than observation-to-materialization, and the window is not a 24-hour wall clock on a third-party estate. S27
Correctness, 6/10. The published 1,368-case corpus reports recall of 0.7628, but its labels were derived with the detector's own vocabulary, its precision is marked a construction artifact by the vendor, and no completed post-quantum handshake is in the corpus. S28
Assurance, not scored. The report states that Qtonic Quantum Corp has no company-held product certification; infrastructure-provider certifications are inherited controls, not Qtonic Quantum Corp attestations. S01
These claims were previously made by Qtonic Quantum Corp or by earlier editions of this index and are contradicted by the evidence. Keeping them visible is part of the correction record.
| Withdrawn claim | Correction | Sources |
|---|---|---|
| QScout Pulse Gold scores 9.42 (edition 2026.5) | Four of the seven cells behind 9.42 were asserted by the vendor instrument, not measured. Re-scored from public evidence, QScout is 8.00 and still first; the instrument is now cited only as a vendor self-measurement. | S27S31 |
| Fifty-six probes are answered per product | No enumeration of 56 probes exists in the instrument code or its published artifacts; the phrase was prose. Edition 2026.7 scores seven cells per product with archived cited URLs, excerpts and rationales. The 30 September source screen reproduced 71 excerpts, did not reproduce 20 and could not access cited sources for 7 cells. | S31 |
| Only product emitting CycloneDX 1.7 | CBOM Secure and another listed scanner document CycloneDX 1.7 output. | S04S20 |
| Only tamper-evident cryptographic history | CBOM Secure claims a tamper-evident asset-change log; the cited material does not specify its integrity-verification mechanism. | S05 |
| Only per-finding reachability model | CBOM Secure documents cross-file call-graph reachability. | S04 |
| Only quantitative harvest-now-decrypt-later model | Other products discuss HNDL and migration priority, but the cited pages do not establish a directly comparable quantitative HNDL formula. | S05S17 |