01
Discover
Point SeQr at a domain, mail server, SSH host or database. It actively probes TLS and certificates, finds origins hiding behind the CDN, and installs nothing.
A measurement study · Indian financial services · 2026
Quantum-safe,
in name only.
We actively measured the TLS behind more than 60 Indian financial-services endpoints. Standard scanners report 0% post-quantum. The real figure is 60%, yet every certificate stays classical and half of firms expose an origin that routes around the protection.
Handshake, as measuredTLS 1.3 · port 443
Passive probe0%
hybrid PQC key exchange detected, n = 53
Active ML-KEM probe60%
hybrid PQC key exchange detected, n = 53
The finding · 01
The edge says safe.
The origin disagrees.
A CDN can terminate TLS with hybrid ML-KEM, and a passive scanner sees only that. Behind it, the origin still runs RSA and X25519, and in half of firms anyone can reach it directly.
- 100%
- of certificates stay classicalRSA and ECDSA, forgeable by a quantum computer. Primary corpus, n = 53.
- 51%
- of firms expose an originReachable outside the CDN edge. n = 118, 95% CI 42 to 60. India 48%, international 62%.
- 0
- are quantum-safe end to endAcross every endpoint measured, edge to origin.
Origin · direct13.x.x.x
origin.examplebank.in
- Certificate
- RSA-2048
- Key exchange
- X25519
- PQC
- none
- Reachable
- from anywhere
Harvest now, decrypt later
CDN edge · what scanners seeCloudflare
examplebank.in
Key exchange X25519MLKEM768
Quantum-safe
Edge and origin · 02
One client, two routes.
The route through the edge negotiates ML-KEM and passes inspection. The second route goes straight to the origin and negotiates what the origin offers, which is classical. Traffic captured on it today can be decrypted once a large quantum computer exists.
SeQr probes both. It finds candidate origins and assesses them directly.
See the method, measurement paper section 4.6How it works · 03
02
Inventory
Every finding becomes a Cryptographic Bill of Materials in CycloneDX 1.6, the machine-readable inventory PCI DSS 12.3.3 and SEBI CSCRF now expect auditors to see.
03
Prioritise
See what to fix first for the hours you have, mapped to PCI DSS, SEBI CSCRF, RBI Q-SAFE and the DST roadmap, with the post-quantum replacement for each algorithm.
Live scan · 04
Inspect any domain.
The same scanner the platform uses, run against the public internet. Pick a recorded example or type a domain. Results take five to forty seconds.
Recorded examples
Inspection certificateRecorded 28 June 2026 · SeQr scanner
razorpay.com
- TLS version
- TLS 1.3
- Certificate
- RSA-2048
- Key exchange
- X25519
- PQC, active probe
- X25519MLKEM768
- Deployment
- Hybrid Deployed
- CDN
- Amazon CloudFront
- Scanned
- CDN edge in 31.3 s
Edge only
Crypto agility
6.5 / 10
Transition-ready
Hybrid post-quantum at the CDN edge. The certificate is classical and the origin is not assessed, so this is not end-to-end.
Findings · 2
| Algorithm | Location | Status | Timeline | Replace with |
|---|---|---|---|---|
| RSA-2048 | razorpay.com:443 (cert) | vulnerable | urgent | ML-DSA-65 (signing), ML-KEM-768 (key exchange) |
| X25519 | razorpay.com:443 (key exchange) | vulnerable | planned | ML-KEM-768 |
Why now · 05
The inventory is
already expected.
Two requirements are live today. Three more land before the end of 2027. Select a marker to read what each one asks for.
2025202620272028
PCI DSS 12.3.3
Since 31 March 2025
Mandatory now
Card-data environments must keep a documented inventory of cryptographic cipher suites and protocols, reviewed at least once a year. SeQr builds that inventory as a CycloneDX CBOM.
Plans · 06
Where should it run?
The SeQr platform
The full audit: active probing, the CBOM, the graph, remediation planning and reports.
- Passive TLS, SSH and mail scanincluded
- Active ML-KEM probe, the real numberincluded
- CycloneDX 1.6 CBOM inventoryincluded
- Origin discovery behind the CDNincluded
- Crypto-asset graph and policy engineincluded
- Remediation planner and signed bundlesincluded
- Scan history and PDF reportsincluded
- SSO with OIDC and SAMLincluded
- Runs anywhere, no sign-upnot included
- Discovery agent for internal systemsnot included
- Zero data egress, offline licence, no telemetrynot included
Pricing depends on asset count and deployment. We quote after a short call, never before.
118
Financial-services domains measured for origin exposure, with 53 in the primary corpus for the handshake study. Every figure on this page comes from that work, with 95% confidence intervals.
PQC readiness of Indian financial services, measurement paper v1.0, 2026.
Read the paper dataContact · 07