The pipeline

Six stages, end to end.

Scanner discovers the estate

Parallel SSH / WinRM port discovery and live host enumeration. The scanner runs deterministically — the same inputs always produce the same graph.

Eight-worker crypto probes

TLS, SSH, DNS interrogated externally — no host install needed. Probes are deterministic, idempotent, and emit structured JSON.

Graph is built

Nodes (hosts) and edges (connections) are captured as graph.json. The graph feeds the orchestrator and is itself an exportable artefact.

OS subagents enrich each node

Linux · FreeBSD · OpenBSD · Solaris · Windows · macOS — three subagents run in parallel via the ICARUS dispatcher. Each subagent SSHes in, audits crypto, discovers further connections, and returns an EnrichedNode payload.

Crypto-DB classifies

310 cipher suites, 23 name variants, IANA + testssl.sh-derived. Every algorithm is mapped to a quantum sensitivity class and a NIST / CNSA 2.0 compliance bucket.

Callback delivers to the dashboard

The enriched graph, per-asset findings and computed QARS-NI score are POSTed to your callback URL. The dashboard renders them; your SOC ingests them.

Webhook contract

Trigger an audit in one POST.

The orchestrator exposes a stable webhook for triggering audits. Targets, credentials, layers and a callback URL are all that's needed. Every audit run is idempotent and produces a signed evidence pack.

REST JSON Signed callbacks Idempotent
// POST /intakes/webhook/pqc-audit { "targets": ["10.0.0.0/24", "prod.example.com"], "creds": "vault://prod/ssh", "layers": ["transit", "use", "rest"], "callback": "https://q.example/cb", "sla": "72h" } → pqc-transit · external probes → pqc-use · runtime crypto → pqc-rest · at-rest crypto → report-delivery subagent → POST callback → ResilQ UI
Deployment topology

Cloud-hosted, sovereign-ready, or hybrid.

Cloud

EU-hosted SaaS

Default deployment. EU data residency in Vilnius. Audit traffic egresses from your environment to the ResilQ orchestrator over TLS 1.3 with hybrid PQC.

VilniusTLS 1.3ML-KEM hybrid
Sovereign

On-prem ICARUS

Full ICARUS orchestrator deployed inside your infrastructure. Air-gap mode supported. Source code shipped for customer audit. The deployment is yours.

Air-gappedSource-shippedSelf-host
Hybrid

SOC integration

Run audits in your environment, ship findings to your SOC. Splunk, Sentinel, Elastic, ServiceNow connectors ship out of the box. Custom adapters on the roadmap.

SplunkSentinelServiceNow
Get started

Ready to see your score?

Free pilot · 25 assets · QARS-NI report in 72h.

Audit now View pricing