The command centre
for cryptographic risk.

QUAMO is CYSTEL’s cryptographic discovery and post-quantum readiness platform. It brings perimeter, cloud, network and code findings into a shared inventory, helping security, technology, risk and application teams understand exposure, prioritise action and plan a governed transition to post-quantum cryptography (PQC).

QUAMO brings together four discovery vectors: Perimeter, Cloud, Network and Code Base. Outside-in assessment observes public domains, subdomains and TLS endpoints without agents or credentials; deeper discovery uses authorised access and container-based sensors as scoped with your team.

An SBOM lists software components, while a certificate inventory focuses on certificates and their lifecycle. QUAMO’s Cryptographic Bill of Materials (C-BOM) brings findings from all four discovery vectors into one registry, connecting protocols, key exchange, cipher suites and PQC status with risk and business criticality.

QUAMO’s AI Threat Amplifier combines four lenses—AI Exploit Probability, HNDL Data Exposure, Trust Path Risk and Assurance Gap—into a composite weighted view. Alongside severity and business criticality, this helps your team prioritise consequential exposure, including harvest-now-decrypt-later (HNDL) risk to long-lived sensitive data.

Ask QUAMO works in the context of your live C-BOM, so you can explore your own cryptographic findings, HNDL exposure and migration priorities. General AI chat is useful for background questions; Ask QUAMO brings the conversation into your discovered inventory and helps technical and business stakeholders understand the next decisions.

QUAMO builds phased roadmaps with estimated cost, effort, timelines and ML-KEM and ML-DSA targets; Ask QUAMO helps you explore hybrid classical-plus-PQC approaches. CYSTEL’s experts work with your team to review dependencies and support controlled implementation across endpoints, infrastructure and applications.

QUAMO uses a SaaS control plane for dashboards, inventory, governance, planning and Ask QUAMO, with Docker-based sensors collecting close to your environment. Collection can expand through additional sensor instances and tenant-isolated cloud deployments, while findings stay consolidated in your tenant’s C-BOM and dashboard.

We agree the discovery scope, permissions, collection methods, data handling and residency requirements with you during solution design. This gives your security and architecture teams a clear basis for reviewing what each collection path needs and how findings flow into your tenant-scoped inventory.

QUAMO’s catalogue spans 26 integration paths across ten security-tool groups, including ServiceNow, Splunk, certificate management and HSM/KMS. We shape your integration plan around the tools, connector capabilities and data flows that matter most to your teams.

QUAMO maps cryptographic findings to 20 tracked frameworks, including NIST PQC standards, CNSA 2.0, DORA and PCI DSS. Coverage indicators, evidence and milestones give your teams a shared view of alignment, so we can coordinate assurance work and prioritise the remediation that moves your programme forward.

QUAMO uses agentless outside-in discovery to assess the public-facing cryptographic posture of supplier domains and endpoints. Portfolio heatmaps, vendor scores and threat summaries help your procurement, risk and security teams prioritise supplier conversations and deeper assurance work, using externally observed evidence rather than access to suppliers’ internal estates.

Your teams can export C-BOM inventory findings as CSV for further analysis and reporting. The Migration Advisory & Planner also provides a CSV action plan with asset, vulnerability, target PQC state and recommended action, helping you coordinate delivery across the teams involved.

Request a QUAMO demo and tell us which systems, suppliers and risk priorities you want to explore. We can begin the discovery conversation with your public-facing domains, then agree the scope, access and collection approach for a broader assessment with your team.

We shape a proposal around your discovery scope, collection requirements and the platform and expert support your organisation needs. Share the domains, cloud environments, networks and codebases you want to assess, and we can discuss the commercial approach alongside your integration and migration priorities.