KXCO Portcullis · Portcullis Survey
Find every weak cipher.Know your exposure.
Other tools hand you a PDF report. Portcullis Survey gives you an ML-DSA-87 attested report of every finding. The code, packages and certificate to fix each one are in development as Portcullis Fortify.
No agents to install · Results attested with ML-DSA-87
TARGET
api.yourservice.com
Remediation plan
npm install kxco-pq-vault kxco-pq-attest
RSA-2048, ECDSA, and elliptic curve Diffie-Hellman will all be broken by quantum computers within this decade. Enterprise crypto scanners require SPAN port access, Linux agents, and months of infrastructure work before you see a single result. Most teams don't have that runway. Portcullis Survey finds every vulnerable component in under 10 seconds and shows where each one is exposed.
Why Portcullis Survey
Enterprise scanners need an infrastructure team.
You need a URL.
Enterprise crypto scanners require SPAN port access, Linux agents, and months of infrastructure setup before you see a single result. Portcullis Survey is the opposite: zero infrastructure, self-serve, results in 10 seconds.
Comparison based on publicly available product documentation from leading enterprise cryptographic posture management vendors, June 2026.
Enterprise scanners — built for large orgs
Portcullis Survey: built for everyone else
URL & TLS Scan
Connect to any HTTPS host and check TLS version, certificate algorithm (RSA/ECC/SHA-1), and cipher suite. Results in under 10 seconds.
Dependency Analysis
Parse any package.json and flag quantum-vulnerable npm packages — node-rsa, elliptic, jsrsasign, jsonwebtoken with RS256, and 10+ more.
Environment Variable Check
Detect PEM-encoded RSA and EC private keys in submitted env vars. Findings never stored — values are scanned and discarded immediately.
Code Pattern Scanner
Regex-based scan of code snippets for RSA key generation, ECDH, SHA-1 signing, MD5, AES-128, RS256/ES256 JWTs, and more.
ML-DSA-87 Attested Report
Every risk report is signed with the platform ML-DSA-87 key and independently verifiable via kxco-verify. Proof of your assessment, forever.
Remediation Plan (in development)
Portcullis Fortify is designed to give each finding npm install commands, before/after migration code and estimated hours, and to issue an ML-DSA-87 remediation certificate on confirmation. This is in development as Portcullis Fortify and is not available today.
How it works
Scan, report, fix — in three steps.
Quantum-safe doesn't mean complicated. Portcullis Survey is as fast as running a linter. The remediation plan is in development as Portcullis Fortify.
Submit any target
10 scan types — no setup for any of them. URL/TLS, package.json (npm), requirements.txt (Python), go.mod, Gemfile, Cargo.toml, pom.xml, nginx/OpenSSL config, Dockerfile, Terraform HCL, GitHub Actions YAML, or Kubernetes manifests. Auto-detected. No agents. No install.
Receive your ML-DSA-87 risk report
In under 10 seconds: risk score (0–100), per-finding severity, blast radius estimate, and the exact package command or config change to fix each issue. The report is signed with ML-DSA-87 and publicly verifiable — not locked in a proprietary dashboard.
Apply the PQC fix (in development)
Portcullis Fortify is designed to generate a full remediation plan with before/after code, install commands and a migration checklist, and to issue an ML-DSA-87 attested certificate of remediation on confirmation. This is in development as Portcullis Fortify and is not available today.
Detection coverage
What we detect, and the recommended fix.
Each finding below shows the recommended replacement. Before/after migration code is in development as Portcullis Fortify.
New · Web Security
Quantum-ready isn't the same as secure today.
Check both in one place.
The crypto scan tells you what quantum computers will break. The Web Security check tells you what's exposed right now. Point Portcullis Survey at any URL and it runs a keyless audit, with no agents and no API keys, then grades your site A to F and signs the report with ML-DSA-87. Distinct from the crypto probe; same ten-second workflow.
Security headers
CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy — present, missing, or misconfigured.
HSTS
Strict-Transport-Security max-age, includeSubDomains and preload — is HTTPS actually enforced?
Cookies
Every cookie checked for Secure, HttpOnly and SameSite flags. Session fixation and theft risks flagged.
Email (SPF/DMARC)
SPF, DMARC and BIMI records — is your domain protected against spoofing and phishing?
DNS & redirects
A/AAAA/MX/NS/TXT records, DNSSEC validation, and the full HTTP→HTTPS redirect chain.
TLS & certificate
Protocol version, cipher suite, certificate issuer and expiry — the same crypto layer, read for hygiene.
Web Security inspects configuration and posture (headers, cookies, mail, DNS, TLS). It is not an application penetration test and does not probe for issues like SQL injection or XSS.
CI/CD Integration
Catch quantum vulnerabilities before they deploy.
Add one file to your repository. Portcullis Survey auto-detects package.json, requirements.txt, go.mod, Gemfile, Cargo.toml, Dockerfiles, Terraform, and Kubernetes manifests. It scans them all and posts an ML-DSA-87 attested report as a PR comment. Blocking the merge on Critical findings is in development and is not available today.
# Add to .github/workflows/bastion-scan.yml
# Set KXCO_TOKEN in: repo Settings → Secrets → Actions
name: Portcullis Survey Scan
on: [pull_request, push]
jobs:
bastion:
runs-on: ubuntu-latest
permissions:
pull-requests: write # for PR comments
steps:
- uses: actions/checkout@v4
- name: Portcullis Survey scan
env:
KXCO_TOKEN: ${{ secrets.KXCO_TOKEN }}
run: |
# Auto-detects: package.json, requirements.txt,
# go.mod, Gemfile, Cargo.toml, Dockerfile, *.tf, k8s/
curl -sf https://pqc.kxco.ai/bastion-scan.yml | bashAdd secret
Create KXCO_TOKEN in repo Settings → Secrets → Actions. Use your API key from the dashboard.
Drop in the file
Copy bastion-scan.yml into .github/workflows/. Auto-detects all manifest and config files in your repo.
Merge with proof
Every PR gets an ML-DSA-87 attested comment, and the CBOM is available for download. Blocking merges on Critical findings is in development.
CycloneDX 1.6 CBOM
Every scan exports a signed CBOM.
Every Portcullis Survey report downloads as a CycloneDX 1.6 Cryptographic Bill of Materials, the industry-standard format for cryptographic asset inventories. Each CBOM is ML-DSA-87 signed and includes NIST quantum security levels, OIDs, and evidence locations for every finding.
{
"bomFormat": "CycloneDX",
"specVersion": "1.6",
"metadata": {
"tools": [{ "vendor": "KXCO by Knightsbridge",
"name": "KXCO Bastion" }],
"properties": [
{ "name": "kxco:riskLevel", "value": "high" },
{ "name": "kxco:attestation", "value": "..." }
]
},
"components": [{
"type": "cryptoAsset",
"name": "RSA",
"cryptoProperties": {
"assetType": "algorithm",
"algorithmProperties": {
"primitive": "asymmetric-encryption",
"nistQuantumSecurityLevel": 0
},
"oid": "1.2.840.113549.1.1.1"
},
"evidence": {
"occurrences": [{
"location": "[email protected]"
}]
},
"tags": ["quantum-vulnerable", "shor-vulnerable"]
}]
}Aligned with
FAQ
Common questions about scanning legacy crypto.
What does "blast radius" mean in the risk report?+
Blast radius is an estimate of the operational impact if a quantum attacker broke your crypto today — exposed operations per day, data at risk in GB, and estimated migration hours. It's a decision-making tool, not a precise measurement.
Are my environment variable values stored?+
Never. Submitted env var values are scanned for PEM headers and key patterns in memory, then discarded immediately. The probe record stores only the finding — variable name, severity, and remediation — never the raw value.
What happens after I click "Apply PQC Fix"?+
Apply PQC Fix belongs to Portcullis Fortify, which is in development and is not available today. It is designed to generate a remediation plan with before/after code and npm commands for every finding, and to produce an ML-DSA-87 signed remediation certificate when you confirm the plan.
Can I scan a production URL?+
Yes. The TLS scanner connects to port 443, reads the certificate chain and TLS version, and disconnects. It makes no HTTP requests beyond the TLS handshake. There is a rate limit of 5 URL scans per hour per account.
How accurate are the findings?+
The scanner detects what it can observe: TLS metadata, dependency names and versions, PEM-encoded keys, and code patterns. It may produce false positives on vendored or compiled code. Each finding includes the specific evidence so you can assess it.
Still have questions? Our team can walk you through how Portcullis Survey fits your stack.
Find quantum-vulnerable cryptobefore someone else does.
Post-quantum cryptography and ML-DSA-87 attested proof — built in from day one.
No agents to install · ML-DSA-87 attested results