Topographer
Post-quantum readiness reports
Every survey produces a post-quantum readiness report that classifies the cryptography found in your software. It answers two questions at once: which components use cryptography that is already broken today, and which use algorithms that a cryptographically relevant quantum computer will break, such as RSA, ECDSA and Diffie-Hellman.
Classification follows NIST’s post-quantum transition guidance (NIST IR 8547), which deprecates quantum-vulnerable algorithms after 2030 and disallows them after 2035.
Get a report
There is nothing extra to run. Each kind of survey produces its own report:
# Inventory: the cryptography present in your artifacts
spice survey inventory payments-api ./build/libs
# Runtime: the cryptography your application runs
spice survey runtime payments-api --jfr -- java -jar app.jar| Report type | Produced by | It answers |
|---|---|---|
| PQC Inventory | An inventory survey | What cryptography is present? |
| PQC Runtime | A runtime survey | What cryptography did the application use while it ran? |
| PQC Static | Static analysis, available in Surveyor IT and Surveyor IT Pro | What cryptography does the code call? |
To open a report, open the menu (☰), choose Surveys, select the survey, then View report → on its PQC card. Or choose Reports in the menu and select the report. See Surveys and reports.
How findings are classified
The cryptographic usage a survey detects is matched against a curated algorithm catalog: a database of cryptographic algorithms, each classified for post-quantum readiness against NIST guidance. Each report records which version of the catalog it was built with, so its results can be reproduced. When the catalog improves, the report offers to refresh itself (Refresh a stale report).
Readiness categories
The report groups your libraries into categories, worst first. Tabs above the list show All or one category at a time.
| Category | Meaning | What to do |
|---|---|---|
| Critical | Banned algorithms: broken by conventional computers today, such as RC2, RC4, DES, 3DES, MD5, SHA-1 and RSA-1024. | Migrate immediately. |
| Needs Review | Libraries that mix quantum-safe and classical algorithms. | Review and plan migration. |
| Plan Migration | Algorithms that are secure today but vulnerable to future quantum attacks, such as RSA above 1024 bits and elliptic-curve algorithms. | Plan migration by 2030 to 2035. |
| Quantum-Safe | Libraries that use only quantum-safe algorithms, such as the NIST-standardized ML-KEM, ML-DSA and SLH-DSA. | No action needed. |
| Uncategorized | Cryptographic usage that could not be matched to a known algorithm. | Review manually. |
A summary at the top shows the share of findings that is quantum-safe and counts the findings in each category. Each library then shows:
- its name, version and package URL (purl), and a “migrate by” date when one applies,
- every cryptographic algorithm detected in it, each badged with its own category,
- an explanation of the classification, with a recommended alternative where there is one,
- the classes and locations where the cryptography was found.
Use the search box to find a library, algorithm or purl in the report.
What a runtime report adds
A PQC Runtime report also records what the instrumented JVM did while it ran:
- Runtime Environment: the JVM version and vendor.
- Event Summary: the total cryptographic events observed and the distinct methods exercised.
- TLS Connections: the host, port, protocol, cipher suite and count for each connection.
- Certificates: the subject, key, signature algorithm and expiry of each certificate seen.
For each algorithm, the runtime report lists the crypto operations it observed, by class and method, with how many times each ran.
Export a report
On the report, open Export and choose a format. A PQC Inventory report offers PDF and JSON. PQC Runtime and PQC Static reports offer PDF, XLSX, CSV, HTML, PPTX and JSON. The menu lists only the formats that have finished rendering for that report.