Use Layer.
Runtime crypto, inspected.
External probes only see the negotiated handshake — they cannot see your code's cryptographic choices. The Use layer reads what your applications actually do at runtime.
The crypto your code chose,
not just what it negotiated.
OS-specific ICARUS subagents log into each host through your existing SSH or WinRM credentials, enumerate runtime cryptographic state, and ship a structured report back to the orchestrator. No persistent installation, no agent footprint after the audit.
Three subagents, in parallel.
Three hosts are enriched concurrently. Each subagent SSHes in, reads configuration files and live process state, classifies algorithms, and discovers further connections — feeding the graph back to the orchestrator.
[node_a, node_b, node_c],
parallelism=3
)
Six classes of runtime exposure.
Signing & verification
Algorithm registry per service. RS256, ES256, EdDSA, HS256 — and which of them are quantum-vulnerable. Token TTL and rotation cadence are recorded.
Library posture
OpenSSL, LibreSSL, BoringSSL, AWS-LC. Build flags, FIPS mode, OQS provider presence,
enabled algorithms — read directly from openssl version -a and config files.
Redis · Kafka · NATS
TLS-on-bus posture, mTLS configuration, ACL/SASL mechanisms, and stored credential format. Every internal hop where crypto might silently downgrade.
Hardware-backed keys
PKCS#11 tokens, AWS KMS, GCP KMS, Azure Key Vault, HashiCorp Vault. Key types, attribute policies, rotation evidence, and PQC support readiness.
Bouncy Castle & friends
BC, libsodium, NaCl, native crypto bindings, language-runtime defaults (JVM, .NET, Node, Python). What your applications actually link against.
mTLS in production
Istio, Linkerd, Consul Connect — control-plane crypto, sidecar TLS posture, and the gap between policy and runtime reality on each pod.
Read-only. Auditable. Self-erasing.
- Subagents are dropped via SSH, executed, and removed at end of audit.
- Every command issued is logged to an immutable audit trail.
- Credentials are pulled at runtime from your vault — never stored by ResilQ.
- Read-only operations. No modification, no privilege escalation, no persistence.
- Sovereign deployment option ships with full source for customer audit.
| OS | Discovery | Runtime | At-rest |
|---|---|---|---|
| Linux | ● | ● | ● |
| FreeBSD | ● | ● | ● |
| OpenBSD | ● | ● | ● |
| Solaris | ● | ● | ∼ |
| Windows | ● | ● | ● |
| macOS | ● | ● | ∼ |
● full coverage · ∼ partial coverage in current release