KXCO Bastion · KXCO Bastion
Find every weak cipher.Fix it in minutes.
Other tools hand you a PDF report. KXCO gives you the exact code, npm packages, and ML-DSA-65 attested certificate to fix every finding.
No credit card · No agents to install · Results attested with ML-DSA-65
TARGET
api.yourservice.com
Remediation plan
npm install kxco-pq-vault kxco-pq-attest
RSA-2048, ECDSA, and elliptic curve Diffie-Hellman will all be broken by quantum computers within this decade. Enterprise crypto scanners require SPAN port access, Linux agents, and months of infrastructure work before you see a single result. Most teams don't have that runway. KXCO Bastion finds every vulnerable component in under 10 seconds and hands you the exact code to replace it.
Why KXCO Bastion
Enterprise scanners need an infrastructure team.
You need a URL.
Enterprise crypto scanners require SPAN port access, Linux agents, and months of infrastructure setup before you see a single result. KXCO Bastion is the opposite: zero infrastructure, self-serve, results in 10 seconds.
Comparison based on publicly available product documentation from leading enterprise cryptographic posture management vendors, June 2026.
Enterprise scanners — built for large orgs
KXCO Bastion — built for everyone else
URL & TLS Scan
Connect to any HTTPS host and check TLS version, certificate algorithm (RSA/ECC/SHA-1), and cipher suite. Results in under 10 seconds.
Dependency Analysis
Parse any package.json and flag quantum-vulnerable npm packages — node-rsa, elliptic, jsrsasign, jsonwebtoken with RS256, and 10+ more.
Environment Variable Check
Detect PEM-encoded RSA and EC private keys in submitted env vars. Findings never stored — values are scanned and discarded immediately.
Code Pattern Scanner
Regex-based scan of code snippets for RSA key generation, ECDH, SHA-1 signing, MD5, AES-128, RS256/ES256 JWTs, and more.
ML-DSA-65 Attested Report
Every risk report is signed with the platform ML-DSA-65 key and independently verifiable via kxco-verify. Proof of your assessment, forever.
One-Click Remediation Plan
Each finding ships with npm install commands, before/after migration code, and estimated hours. Confirming generates an ML-DSA-65 remediation certificate.
How it works
Scan, report, fix — in three steps.
Quantum-safe doesn't mean complicated. KXCO Bastion is as fast as running a linter — with a remediation plan ready to ship.
Submit any target
10 scan types — no setup for any of them. URL/TLS, package.json (npm), requirements.txt (Python), go.mod, Gemfile, Cargo.toml, pom.xml, nginx/OpenSSL config, Dockerfile, Terraform HCL, GitHub Actions YAML, or Kubernetes manifests. Auto-detected. No agents. No install.
Receive your ML-DSA-65 risk report
In under 10 seconds: risk score (0–100), per-finding severity, blast radius estimate, and the exact package command or config change to fix each issue. The report is signed with ML-DSA-65 and publicly verifiable — not locked in a proprietary dashboard.
Apply the PQC fix
One click generates a full remediation plan: before/after code, install commands, and migration checklist. Confirming produces an ML-DSA-65 attested certificate of remediation — cryptographic proof of your migration, verifiable by anyone.
Detection coverage
What we detect — and fix.
Every finding includes an exact KXCO package command and before/after migration code.
CI/CD Integration
Block quantum vulnerabilities before they deploy.
Add one file to your repository. KXCO Bastion auto-detects package.json, requirements.txt, go.mod, Gemfile, Cargo.toml, Dockerfiles, Terraform, and Kubernetes manifests — scans them all, posts an ML-DSA-65 attested report as a PR comment, and blocks the merge on Critical findings.
# Add to .github/workflows/bastion-scan.yml
# Set KXCO_TOKEN in: repo Settings → Secrets → Actions
name: KXCO Bastion Scan
on: [pull_request, push]
jobs:
bastion:
runs-on: ubuntu-latest
permissions:
pull-requests: write # for PR comments
steps:
- uses: actions/checkout@v4
- name: KXCO Bastion scan
env:
KXCO_TOKEN: ${{ secrets.KXCO_TOKEN }}
run: |
# Auto-detects: package.json, requirements.txt,
# go.mod, Gemfile, Cargo.toml, Dockerfile, *.tf, k8s/
curl -sf https://pqc.kxco.ai/bastion-scan.yml | bashAdd secret
Create KXCO_TOKEN in repo Settings → Secrets → Actions. Use your API key from the dashboard.
Drop in the file
Copy bastion-scan.yml into .github/workflows/. Auto-detects all manifest and config files in your repo.
Merge with proof
Every PR gets an ML-DSA-65 attested comment. Merges are blocked on Critical findings. CBOM available for download.
CycloneDX 1.6 CBOM
Every scan exports a signed CBOM.
Every KXCO Bastion report downloads as a CycloneDX 1.6 Cryptographic Bill of Materials — the industry-standard format for cryptographic asset inventories. Each CBOM is ML-DSA-65 signed and includes NIST quantum security levels, OIDs, and evidence locations for every finding.
{
"bomFormat": "CycloneDX",
"specVersion": "1.6",
"metadata": {
"tools": [{ "vendor": "KXCO by Knightsbridge",
"name": "KXCO Bastion" }],
"properties": [
{ "name": "kxco:riskLevel", "value": "high" },
{ "name": "kxco:attestation", "value": "..." }
]
},
"components": [{
"type": "cryptoAsset",
"name": "RSA",
"cryptoProperties": {
"assetType": "algorithm",
"algorithmProperties": {
"primitive": "asymmetric-encryption",
"nistQuantumSecurityLevel": 0
},
"oid": "1.2.840.113549.1.1.1"
},
"evidence": {
"occurrences": [{
"location": "node-rsa@1.1.1"
}]
},
"tags": ["quantum-vulnerable", "shor-vulnerable"]
}]
}Aligned with
FAQ
Common questions about scanning legacy crypto.
What does "blast radius" mean in the risk report?+
Blast radius is an estimate of the operational impact if a quantum attacker broke your crypto today — exposed operations per day, data at risk in GB, and estimated migration hours. It's a decision-making tool, not a precise measurement.
Are my environment variable values stored?+
Never. Submitted env var values are scanned for PEM headers and key patterns in memory, then discarded immediately. The probe record stores only the finding — variable name, severity, and remediation — never the raw value.
What happens after I click "Apply PQC Fix"?+
KXCO generates a remediation plan with before/after code and npm commands for every finding. Confirming the plan produces an ML-DSA-65 signed remediation certificate — proof that the assessment was completed, independently verifiable.
Can I scan a production URL?+
Yes. The TLS scanner connects to port 443, reads the certificate chain and TLS version, and disconnects. It makes no HTTP requests beyond the TLS handshake. There is a rate limit of 5 URL scans per hour per account.
How accurate are the findings?+
The scanner detects what it can observe: TLS metadata, dependency names and versions, PEM-encoded keys, and code patterns. It may produce false positives on vendored or compiled code. Each finding includes the specific evidence so you can assess it.
Still have questions? Our team can walk you through how KXCO Bastion fits your stack.
Find quantum-vulnerable cryptobefore someone else does.
Post-quantum cryptography and ML-DSA-65 attested proof — built in from day one. Start free, no card required.
No credit card required · No agents to install · ML-DSA-65 attested results