Pilot or Discovery at a glance

The Pilot baselines one critical domain. Discovery covers your estate at scale. Both are fixed in scope, so the price you see is the price you budget.

Prices exclude any Migration advisory, which is billed separately. Source: public pricing.
	PQC Readiness Pilot €18,000	Discovery €45,000
Pricing	Fixed scope, at a reference-programme rate in exchange for a public reference and a 30-minute case-study interview	Fixed fee
Scope	3–5 repositories and up to 20 TLS endpoints, covering one critical domain	Up to 50 repositories, 100 TLS endpoints and your certificate stores, plus 1 results workshop
Duration	Agreed in the statement of work	60 days
Outputs	Sample CycloneDX CBOM Quantum-risk summary Executive overview	Full discovery across code, certificates and TLS CycloneDX 1.6 Crypto-BOM Board-ready PDF executive report 4-wave migration roadmap Regulatory mapping (DORA, NIS2, CRA)
Where it runs	Inside your environment, including on-prem or air-gapped, or on a dedicated VM in France. See where your code and data go.
Who it is for	Teams that want a first, evidence-based baseline before committing to a full Discovery, and are happy to be a public reference. Places are limited to the first five reference customers.	Organisations that need a complete, defensible inventory and roadmap across their estate, for the board, auditors and the migration programme.

What you receive

Each deliverable is an open format you keep: a CycloneDX CBOM your GRC tooling can ingest and a PDF your board can read without our platform. The samples below are public, so you can judge the output before you buy. Fixtures are labelled illustrative.

Discovery · Pilot: within its scope

Discovery across code, certificates and TLS

Source code in Python, JavaScript / TypeScript, Java, Go and C / C++; X.509 certificates (PEM, DER, CRT, CER) with issuer, validity and signature algorithm; live TLS endpoints with negotiated protocols and cipher suites. Every finding keeps its provenance (file and line, or endpoint) and is tagged by scope, so test fixtures and vendored code are not confused with production.

Sample: explore all 1,804 detections from a real scan

Discovery · Pilot: sample CBOM

CycloneDX 1.6 Crypto-BOM

Each cryptographic asset as a standard CycloneDX component: algorithm family and primitive, key size or curve, mode and padding where detected, certificate validity, quantum-security status and source location. Validated against the official CycloneDX 1.6 JSON schema before delivery. No source code is included in the file.

Samples: illustrative fixture CBOM (JSON) · verified pyca/cryptography CBOM and case study

Discovery · Pilot: risk summary

Quantum-risk scoring

A 0–100 score per asset, with written reasoning, based on algorithm, key size, data lifetime and harvest-now-decrypt-later (HNDL) exposure. Each finding is mapped to its replacement (ML-KEM, ML-DSA or SLH-DSA). Sensitivity can be set per path with a policy file.

Samples: HNDL calculator · anatomy of a finding (illustrative) · sample sensitivity policy

Discovery · Pilot: executive overview

Board-ready PDF executive report

The summary your CISO sends the board, mapped to DORA, NIS2, the EU CRA and FIPS 203 / 204 / 205. The narrative is policy-generated, with a deterministic offline mode and optional assistance from an EU-sovereign language model you choose.

See: how discovery, scoring and delivery fit together

Discovery

4-wave migration roadmap

Findings sequenced into four migration waves with effort estimates, from quick wins to the asymmetric cryptography that needs post-quantum replacements. In the illustrative fixture, MD5 and SHA-1 move to SHA-2 in wave 1 and RSA-OAEP key transport moves to ML-KEM in wave 2.

See: crypto-agility and migration planning

Discovery

Regulatory mapping

Findings and roadmap set against the cryptography expectations of DORA, NIS2 and the Cyber Resilience Act, so your risk and compliance teams can use them as evidence. More below.

See: DORA Article 9 · NIS2 Article 21

How the engagement runs

The same sequence applies to the Pilot and to Discovery. Discovery runs for 60 days in total; the Pilot timeline is set in its statement of work.

Contracts and scoping. A mutual NDA, a statement of work (scope, deliverables, timeline, fees and liability) and a GDPR Article 28 data processing agreement are signed before any technical work. Together we list the repositories, TLS endpoints and certificate stores in scope.
Deployment. Either CRYPTAGION runs inside your environment (your servers, a CLI, your CI/CD or fully offline), or we run it for you on a dedicated VM in France, with code reaching us the way you choose.
Discovery runs. Static analysis of source code, X.509 certificate parsing and live TLS handshakes build the cryptographic inventory.
Scoring and analysis. Each asset is risk-scored with its reasoning, HNDL exposure and recommended replacement, then sequenced into migration waves.
Results workshop. Discovery includes one workshop to walk your team through the findings and the roadmap.
Deliverables handover. The CBOM is schema-validated before delivery. When we run the scan, deliverables are pushed to a destination you control with SHA-256 checksums. Deliverables are your property.
Data destruction (dedicated VM only). Within 7 days of closure the VM is destroyed and you receive a signed data destruction certificate.

Where your code and data go

There are two ways to run an engagement, and they handle your source code differently. Pick the one your security review prefers.

In your environment: your code never leaves your perimeter

Runs on your servers, as a CLI, in your CI/CD, or fully offline (air-gapped).
Analysis, scoring, CBOM and report generation all run locally.
Your source code is never uploaded to us. Only aggregated findings are produced.

Deployment & data flow →

We run it for you, in France

A dedicated VM per engagement, on a server we lease from OVHcloud in Gravelines, France. Never shared between customers.
No customer data is transferred to or processed outside the European Economic Area.
Code reaches us by a read-only deploy key on a mirror you control, a one-time expiring transfer, or a live screen-share scan.
VM destroyed within 7 days of closure, with a signed destruction certificate.

Trust center: deployment models and controls →

Demos are different again: we only ever scan public repositories, so a demo never involves your code.

What we need from you

A named technical or security contact for the engagement.
The signed NDA, statement of work and data processing agreement. Templates are available before you commit.
The list of repositories, TLS endpoints and certificate stores in scope.
Either a place to run CRYPTAGION in your environment (a server, a CI runner or an offline machine), or read-only access to the code by one of the three routes above.
Optionally, the sensitivity and confidentiality lifetime of your data, so HNDL scoring reflects your reality (see the sample policy).

Regulatory mapping: DORA, NIS2, CRA

Discovery maps its findings and roadmap to DORA, NIS2 and the Cyber Resilience Act, and the executive report also references FIPS 203, 204 and 205. Sector guides: DORA for banks, DORA for insurers, NIS2 Article 21, EU PQC roadmap.

CRYPTAGION supports compliance activities; use of the product does not by itself establish regulatory compliance.

After Discovery

Platform, from €80,000 per year

Continuous scans, CI/CD and API integration, quarterly CBOM refresh and alerts on new cryptography. CI/CD gate →

Migration advisory, billed separately

Hands-on migration support and crypto-agility design, delivered directly or through your security integrator. Partners →

The path: PQC Readiness Pilot (€18k) → Discovery (€45k) → Platform (from €80k/year). Full details in the public pricing.

Questions about the engagement

What is the difference between the Pilot and Discovery?

Scope and outputs. The Pilot covers 3–5 repositories and up to 20 TLS endpoints and produces a sample CBOM, a quantum-risk summary and an executive overview. Discovery covers up to 50 repositories, 100 TLS endpoints and your certificate stores over 60 days, and adds the full CycloneDX 1.6 Crypto-BOM, the board-ready report, the 4-wave roadmap, regulatory mapping and a results workshop.

Does our source code leave our environment?

Not if CRYPTAGION runs in your environment: only aggregated findings are produced, and air-gapped runs are supported. If you prefer us to run the scan, your code is processed on a dedicated VM in France, never outside the European Economic Area, and the VM is destroyed within 7 days of closure with a signed destruction certificate.

Can our security and legal teams review everything before we commit?

Yes. The security posture document (PDF) is public, and NDA, statement of work and DPA templates are available on request from the trust center. We reply within one business day.

Who owns the deliverables, and what if we stop working with you?

Deliverables are your property under the statement of work. They are open standards (CycloneDX CBOM, PDF) and remain fully usable without our platform.

Will Discovery make us DORA, NIS2 or CRA compliant?

No tool does that on its own. CRYPTAGION supports evidence for cryptographic risk-management, resilience and governance activities relevant to those frameworks; use of the product does not by itself establish regulatory compliance.

Can we see it work before we buy?

Yes. The free 30-minute demo scans a public repository live, one of your open-source projects or a library your stack depends on, and you leave with a real CBOM. No payment until you have seen it work.

A fixed-fee post-quantum discovery your procurement team can buy