Cryptographic discovery & migration for OT & critical infrastructure
See the cryptography that actually runs on your network, starting with what has no protection at all.
ClaveQ passively inventories the cryptography across your IT and OT estate: the clear text, the ageing classical encryption, and anything already quantum-safe. From that it builds a standards-based Cryptography Bill of Materials and a migration plan you can act on, without sending a single packet onto the network it watches.
No agents. No decryption. Designed for live safety networks.
Why now
The clock starts when data is captured — not when quantum arrives.
Harvest now, decrypt later: an attacker can store traffic intercepted today and decrypt it once a quantum computer can break classical encryption. For OT and critical-infrastructure data that must stay secret for years, sometimes decades, that data is exposed now. Before you can migrate it, you have to find it.
A staged national timeline
The NCSC's migration guidance sets discovery by 2028, high-priority migration by 2031 and full migration by 2035. It is guidance rather than law, but it is the yardstick UK boards and regulators are adopting.
The target algorithms exist
NIST has finalised the post-quantum standards — ML-KEM, ML-DSA and SLH-DSA. What to migrate to is settled. The work now is finding where the vulnerable algorithms still run.
The baseline is rising
The EU Cyber Resilience Act is in force, and its obligations land from 2026. In the UK, the network-and-information-security rules covering essential-services operators are being strengthened. A cryptographic inventory is where that work starts.
How it works
One mirror port. Four passive steps.
ClaveQ connects to a mirror port and listens. It never transmits onto the network it monitors, never decrypts, and never touches the devices it assesses.
Listen passively
A mirror port on your switch (often called a SPAN port) or a network TAP (a small device that copies traffic from a cable) supplies a copy of the traffic. ClaveQ sends zero packets onto the monitored network.
Read IT & OT protocols
ClaveQ parses Modbus, DNP3, OPC UA, S7comm, TLS, SSH and more, down to the cipher in use where there is one.
Rate the exposure
Each connection gets a rating of unencrypted, quantum-vulnerable or quantum-safe, with the evidence attached.
CBOM & compliance
Out comes a standards-based Cryptography Bill of Materials and a prioritised migration plan.
What it gives you
A clear cryptographic picture of a network nobody else will touch.
Completely passive
Zero packets transmitted onto the monitored network. No decryption, no agents. We designed it to run against live OT and safety-critical networks.
The cryptography actually in use
The cipher suites, key exchange and certificates seen on the wire across IT and OT, not an inventory guess.
Quantum-risk classification
Every connection gets a rating, with harvest-now-decrypt-later exposure kept separate from authentication risk.
A real, standards-based CBOM
A machine-readable Cryptography Bill of Materials in CycloneDX 1.7, the open bill-of-materials standard (published by Ecma as ECMA-424), tested against the official schema. Not a PDF that borrows the name.
Mapped to the frameworks
Findings map to IEC 62443, NERC CIP (North America), CNSA 2.0 and the EU Cyber Resilience Act. Migration phases are set against the NCSC timeline.
A migration plan that tracks
ClaveQ re-measures a prioritised roadmap over time, so you can show progress and prove what has been fixed.
Honest coverage
Every scan reports how completely it observed the traffic.
Fits your estate
Runs as an appliance or a container, with local sign-in (password plus authenticator code) for sites that are air-gapped or have no internet connection, and SIEM export.
See the real output
An excerpt of the actual file, so you can check it yourself.
Below is a trimmed excerpt of real ClaveQ Scan output for the "Cloud historian sync" row above: one TLS 1.3 connection from an on-site historian to a cloud service, with example IP addresses. Values and references appear exactly as the product writes them; we only left fields out. The downloadable file below is the same output with some internal fields removed, and it validates against the official CycloneDX 1.7 schema.
{
"bomFormat": "CycloneDX",
"specVersion": "1.7",
"components": [
{
"type": "cryptographic-asset",
"bom-ref": "protocol-873597c205a90e76906c",
"name": "TLS link 10.20.30.15 → 203.0.113.40:443",
"cryptoProperties": {
"assetType": "protocol",
"protocolProperties": {
"type": "tls",
"version": "TLSv13",
"cipherSuites": [
{
"name": "TLS_AES_256_GCM_SHA384",
"algorithms": [
"algorithm-873597c205a90e76906c-0",
"algorithm-873597c205a90e76906c-1"
]
}
]
}
},
"properties": [
{ "name": "claveq:crypto_risk", "value": "QUANTUM_SAFE" },
{ "name": "claveq:hndl_exposed", "value": "false" }
]
},
{
"type": "cryptographic-asset",
"bom-ref": "algorithm-873597c205a90e76906c-0",
"name": "X25519MLKEM768",
"cryptoProperties": {
"assetType": "algorithm",
"algorithmProperties": {
"primitive": "kem",
"algorithmFamily": "ML-KEM",
"nistQuantumSecurityLevel": 3,
"cryptoFunctions": ["encapsulate", "decapsulate"]
},
"oid": "2.16.840.1.101.3.4.4.2"
}
}
],
"dependencies": [
{
"ref": "protocol-873597c205a90e76906c",
"dependsOn": [
"algorithm-873597c205a90e76906c-0",
"algorithm-873597c205a90e76906c-1"
]
}
]
}-
One connection, as observed
An on-site historian sends data to a cloud service over TLS 1.3. ClaveQ read this from the connection set-up, which travels unencrypted. It decrypted nothing and sent nothing onto the network.
-
The key exchange in use
Hybrid: a classical key exchange combined with ML-KEM-768, the NIST post-quantum standard (FIPS 203), at NIST security level 3.
-
ClaveQ's verdict
Rated quantum-safe.
hndl_exposed: falsemeans data recorded from this connection today cannot be decrypted later by a quantum computer. On a vulnerable connection ClaveQ sets this flag, and it drives migration priority. -
Linked, not listed
ClaveQ ties each connection to every algorithm it relies on, so an auditor's tool can trace connection → cipher suite → algorithm. The full download also includes the AES-256 entry and the scan details trimmed from this excerpt.
Schema-validated
We test our CBOM generator against the official CycloneDX 1.7 / ECMA-424 schema on every code change.
New to CBOMs? What a CBOM is, and what to do with one →
Why ClaveQ
Built for the networks you cannot take risks with.
Nothing is sent
The safety case comes first. A tool that has to inject traffic or decrypt to see your cryptography does not belong on a critical national infrastructure (CNI) network.
Results you can defend
Every verdict carries the evidence behind it: the kind of answer you can put in front of an auditor or a regulator.
Portable by default
Your CBOM uses an open standard, not a format we control. You keep the audit trail and can export it.
Private beta
We are opening early access to a small number of critical national infrastructure operators.
If you run operational technology in water, energy, healthcare or manufacturing and want an early look, we would like to hear from you.
Required to reply to your enquiry. See our privacy notice.