C121.05%
Discovery
How broadly and deeply does the product find cryptographic assets?
Guide 02 / Buyer framework
How to evaluate post-quantum discovery tools
Start with coverage, then force every claim through an evidence test. The best evaluation distinguishes what a product can find from what a buyer can independently prove.
The seven-part evaluation
C215.79%
Evidence artifact
Does it produce a portable, verifiable record of what was found?
C315.79%
Change detection
Can it detect and preserve material changes over time?
C415.79%
Risk quantification
Does it turn inventory into a defensible migration priority?
C510.53%
Correctness
Is detection accuracy measured against named ground truth?
C610.53%
Remediation loop
Can a finding move through ownership, action and verified closure?
C710.53%
Reporting
Can technical and executive readers understand and reuse the result?
The two questions most vendors cannot publicly answer
What is measured detection accuracy against a named corpus? An inventory without known recall can hide false negatives behind a large result count.
Can a third party verify the CBOM is unaltered? A portable artifact with a public verification procedure is stronger evidence than a dashboard export whose provenance cannot be checked.
Use the framework
Open the full methodology, compare the 2026.5 rankings, and inspect the numbered evidence record.