Half your risk exposure sits in someone else's code, and you are still accountable for it.
Quantum risk, managed today, across what you build and what you buy.
01 · Our products
QuCode finds the quantum-vulnerable cryptography. QuTrust governs and evidences the migration. Two products, entered at the level that matches your team, your data, and your operating environment.
QuCode finds the quantum-vulnerable cryptography. It looks at the code, the dependencies, the certificates and the services, in what you build and in what you buy, and tells you what is actually there.
Start here when the first question is "where is it?"
QuTrust governs and evidences the migration. It analyzes what the findings mean, sequences the work against dependencies and deadlines, and produces the evidence your auditors, regulators and board ask for.
Start here when the first question is "in what order, and prove it."
Run either one on its own. Run both and the finding, the sequence and the evidence stay connected.
02 · The problem
Attackers are recording encrypted data today and storing it, waiting for a quantum computer powerful enough to unlock it. That data includes contracts, health and personnel records, intellectual property, credentials, and anything else that has to stay secret for years.
Regulators and standards bodies have responded with published deadlines to migrate to post-quantum cryptography, the new mathematics that quantum computers cannot break. The migration itself is the hard part, and a large share of it sits inside software, devices and services you did not write.
Half your exposure lives in someone else's code, and every change to your environment changes the rest. You need a system that keeps telling you which keys and locks to fix, and which supplier owns them.
03 · What QuTrust is
In any sizeable organization, cryptography sits in thousands of places across software, devices, cloud services, and vendors. Most cannot yet say where all of it lives, and even fewer can say which of it belongs to a third party.
QuTrust analyzes the cryptography your existing tools already find, sequences the work to replace it across Cloud, IT, OT, AI, and Blockchain, and produces the evidence your risk managers, auditors, regulators, and board ask for.
QuTrust closes the gap most IT, cyber, and security teams face.
04 · The difference
You probably already own scanners. Keep them. QuTrust does not replace them and does not compete with them. It reads their output, along with your certificate tools, your cloud, your code and your system of record, and turns all of it into a single managed migration with an owner, a sequence and a deadline for every item.
A list of findings is not a plan. QuTrust is the plan, and the proof that you executed it.
05 · How QuTrust works
QuTrust takes the raw output your existing tools already produce and works out what it means. What is vulnerable, how badly, how long the data behind it must stay secret, and how hard the system will be to change.
It turns that into an ordered plan with the regulatory lens applied, so the first item on the list is the right first item and you can show why.
It produces the evidence, on demand, that your board and your regulators ask for. Not a document that goes stale the day it prints.
These are loops, not steps. They run continuously and feed each other. The plan updates as work completes and as your environment changes.
The services and systems you rent, including managed services where the provider controls the cryptography.
Your own networks, certificates, identity systems, applications and code.
Operational technology. The controllers, sensors and specialized cryptographic hardware that keep physical operations and high-value transactions running.
Model endpoints, training pipelines, model integrity and the systems around them. The newest surface, and the one almost nobody is analyzing yet.
Distributed ledger technology. Blockchains, bridges, custody systems, smart contracts, and the keys your validators and nodes sign with.
Covering all five as one coordinated program is the difference between a migration and five disconnected projects.
Distributed ledgers are the hardest place in the estate to fix, for a reason unique to them. Everywhere else, you replace a weak signature and move on. On a ledger, the record is permanent. You cannot go back and re-sign history, and every signature already written stays readable to whoever eventually holds a quantum computer.
Bridges concentrate that risk further, because a single set of keys often controls value moving between chains.
If you are running tokenized assets, digital issuance, stablecoin infrastructure, a settlement network or a provenance ledger, this surface is not future work. It is the one with the shortest window and the least room to correct later.
06 · Who it is for
Everyone works from the same migration. Each person sees the part they are accountable for.
You need to know where the risk actually is, how bad it is, and what happens first. QuTrust gives you the exposure picture across all four surfaces and the sequence to reduce it.
07 · What you get
Where your organization stands. Findings, severity, what depends on what, which exposures belong to a vendor, and which are driven by a regulatory deadline rather than by technical severity alone. Written so a board can read it and an auditor can check it.
What to fix, in what order, by when, and how far along you are. It updates as work completes and as regulations move. When a supervisor asks where you are, this is the answer, current on the day they ask.
08 · Integrations
QuTrust ingests from the tools already in your environment. Vulnerability scanners, certificate and key management platforms, cloud providers, code repositories, OT monitoring, and your system of record.
Do not see yours? We build connectors. Ask us.
Integration is via documented APIs and standard protocols. All product and company names are trademarks of their respective owners. Listing does not imply partnership or endorsement.
09 · Why us
The founders of ArcQubit introduced the first formal academic definition of Dual Quantum Technology Risk Exposure.
Our founding team comes from national laboratories, defense, and international nuclear cybersecurity, with more than twenty publications across IEEE, ANS, and IAEA forums.
We are not repackaging someone else's tech. We built the framework this category is measured against.
Dual Quantum Technology Risk Exposure is the condition where an organization faces both 1) security risk from cryptographic attacks and 2) strategic risk from delaying quantum adoption [1].
[1] S. M. Rosado et al., "Quantum Technology Readiness Adoption Model," IEEE QCNC 2026, pp. 392-394, doi: 10.1109/QCNC69040.2026.00072.
10 · How it scales
QuTrust runs on four tiers, from a hosted SaaS to a fully offline, air-gapped deployment. Pricing is custom and discussed in the first conversation.
Custom · Billed annually
We operate QuTrust in the region you choose. Nothing to stand up, and data residency stays inside that region.
Best for · Teams without spare infrastructure.
Custom · Billed annually
Deployed into your own cloud account, inside your network boundary, with your keys and your identity provider.
Best for · Cloud-first institutions.
Custom · Billed annually
Runs entirely on your infrastructure. No outbound dependency, and nothing about your estate leaves your perimeter.
Best for · Residency-limited estates.
Custom · Billed annually
Self-run, air-gapped analysis. No connectivity, no telemetry, no licence call-home.
Best for · Defense and government.
QuCode runs on tiers 1–3. QuTrust is the only product available at tier 4, fully offline. If nothing may leave your perimeter, that is a supported configuration here, not an exception we negotiate. Services, including assessment, advisory and implementation support, are scoped and priced separately.
Talk to us about scope11 · GRC Program Ready
Four different things get sold in this market. They sound similar. They are not, and the difference is where most post-quantum programs go wrong.
| Level | The question it answers | What it is | Position |
|---|---|---|---|
| 1. Inventory | What do we have? | A census of every algorithm, certificate and library, and where each one lives. It has no opinion. A complete inventory tells you nothing about risk. | Ingested |
| 2. Assessment | Where are we? | Exposure at a point in time. Findings, severity, what depends on what. Inventory plus judgment. It ends at the truth. | QuTrust |
| 3. Roadmap | In what order, and by when? | The work sequenced across years, respecting dependencies, vendor timelines and deadlines. It moves as reality moves. | QuTrust |
| 4. Action plan | Who does what, starting Monday? | Named person, named system, specific change, due date. It lives in your ticketing system, not ours. | Customer-owned |
The common failure is simple. A vendor delivers a lower level and names it a higher one. Inventory gets called assessment. Assessment gets called a roadmap. Each step up sounds more valuable, so the naming drifts while the deliverable stays put. Buyers pay for a program and receive a list.
Compliance mapping is not a fifth level. It is a lens that runs across all four. Knowing which regulation cares about which finding does not change what you have or what breaks first. It changes what you do first, and a technically moderate finding can go straight to the top because a legal deadline sits behind it. A vendor selling mapping as the whole program is selling a filter and calling it a plan.
We do not write your tickets or assign your people. We do check whether the change actually happened, because a closed ticket is a claim and a changed system is evidence.
12 · Coverage
A weak algorithm is weak everywhere. What changes by jurisdiction and sector is which rule applies, what it requires, and whether it carries consequence. QuCode's rescans keep the inventory current as new cryptography appears. QuTrust maps that inventory to the instruments below, and keeps the mapping current as both your estate and the rules move.
| Instrument | Coverage | Status |
|---|---|---|
| DORA and its technical standards | European Union, financial entities | Binding law |
| CNSA 2.0 | United States, national security systems | Mandatory NSS policy |
| Executive Order 14412 | United States, specified federal high-value and high-impact systems; supplier rule proposed | Mandatory directive / proposed |
| Instrument | Coverage | Status |
|---|---|---|
| NIST standards and transition guidance | Global reference, status marked where draft | Advisory / draft |
| NCSC, ANSSI, BSI and NCSC-NL national guidance | United Kingdom, France, Germany, Netherlands | Advisory |
| G7 Cyber Expert Group, FS-ISAC, Europol Quantum Safe Financial Forum | Financial sector | Advisory |
This is today's shortest, most concrete list of dated post-quantum clocks, not the full set of frameworks QuTrust maps to. As NERC CIP, HIPAA, FISMA, CMMC, SOC 2 and ISO 27001 publish their own post-quantum timelines, QuTrust's compliance mapping extends to them the same way.
Where this matters most is when two of your regulators disagree. European certification guidance requires combining old and new cryptography together. United States guidance permits it without requiring it. A system serving both markets needs both positions recorded against it and a decision made.
We do not just tell you what your regulator wants. We tell you what to do when two of your regulators want different things.