EU roadmap: PQC transition starts 2026 — critical systems by 2030

Turn vulnerability scan reports into a cryptographic inventory

Upload an existing Nessus, OpenVAS or Qualys XML report. qReflector extracts the cryptographic evidence, connects it to hosts and services, scores the risk, and gives your team a structured workspace for review and export.

Request access Explore the PQC Learning Hub

qReflector dashboard showing hosts, services and cryptographic risk classifications

Proprietary risk scoring — every score traces back to findings in your report.

Hosts, services and libraries — inventoried from one uploaded report.

Drill down from host to service to certificate. Each finding keeps its evidence.

Why now

Encrypted traffic can be recorded today and decrypted once quantum computers mature — “harvest now, decrypt later”. That is why European authorities anchor the post-quantum transition to fixed dates instead of waiting for the technology, and why every published roadmap starts the same way: know where your organisation uses cryptography.

2026

EU member states start the PQC transition

2028

NCSC: cryptographic discovery complete

2030

Critical infrastructure migrated — BSI harvest-now protection deadline

Sources: EU Coordinated Implementation Roadmap NCSC PQC migration timelines NIST IR 8547

Start with the scans you already run

Vulnerability scanners already capture protocols, certificates, cipher suites, key exchange, key sizes and cryptographic libraries — distributed across a much larger report, mixed in with hundreds of unrelated findings. qReflector extracts that evidence, scores it with a proprietary cryptographic risk model, and turns it into a reviewable inventory.

Nessus XML OpenVAS XML Qualys XML

Practical questions the result answers:

Which hosts have cryptographic findings?
Which configurations need attention?
What caused the host's risk classification?
Who owns the affected host?
What should be shared or exported?

How it works

You upload Inside qReflector You export

1 Vulnerability scan report

2 Cryptographic evidence

3 Hosts and services

4 Risk and review

5 Cryptographic inventory

6 Excel · CycloneDX CBOM

From risk badge to the finding behind it

Each host inherits the most severe risk of its services, so teams see where to start. From the host view it is one click to the service detail — the certificate, cipher suites and findings that determined the classification. Every finding is scored against two separate questions: is this cryptography acceptable today — and will it need attention during the post-quantum transition? Deprecated protocols, small keys and weak cipher suites are a problem against today's classical attacks; no quantum computer required.

Everything about a host in one place

The host view shows the current risk classification, detected services and libraries with their own risk, the assigned owner, and review status including accepted risks. From there it is one click to the service that caused the classification.

Host risk reflects the most severe affected service
Review all detected services from one host view
Assign responsibility to a host owner

qReflector host view header showing the risk badge, score and host ownership fields — Host view: risk classification, ownership and host context. Click for the full host detail.

qReflector service detail table of certificate and cipher-suite findings with risk and score — Service detail: the certificate, cipher suites and findings that determined the classification.

Depending on the scanner evidence, qReflector can represent information such as:

Protocol version Cipher suite Key-exchange algorithm Signature algorithm Key type and key size Certificate validity

The service risk is calculated from the cryptographic findings associated with that service.

Risk labels

Critical High Medium Fair Q-Safe

Critical–Fair reflect present-day cryptographic weaknesses; Q-Safe reflects post-quantum relevance in the uploaded report — see the full scope below.

Add operational context

qReflector adds a cryptography-focused review layer on top of the evidence your scanner already produced — and exports the reviewed result for hand-over.

Review, comments and ownership

Inspect detected cryptography without navigating the full vulnerability report, record technical context in comments, and assign each host an owner so findings reach the responsible team.

Accept a risk

Record that a finding has been reviewed and consciously accepted, for example for a legacy system or an operational exception. The decision is stored alongside the finding.

Customer and network workspaces

Consultants and assessors can organise findings by customer or network workspace.

Excel export

Download reviewed findings as an Excel workbook for team review, filtering, reporting and customer delivery.

CycloneDX CBOM export

Export structured cryptographic data in CycloneDX CBOM format for broader inventory and CBOM-management processes.

Built for technical teams and assessors

IT and security teams

Work through the cryptography in the scans you already run, and see which hosts and services deserve attention first.

Weak and deprecated configurations in one place
Trace the finding behind each risk label

Consultants and assessors

Process reports from multiple customers and produce deliverables you can hand over directly.

Less manual scanner-report analysis
The same workflow across all customers

A clear and focused scope

What qReflector does

A network-focused cryptographic inventory built from supported vulnerability reports
Host, service and finding-level review with proprietary risk scoring
Ownership, comments and accepted-risk records
Excel and CycloneDX CBOM exports

What qReflector does not do

Replace Nessus, OpenVAS or Qualys, or scan the network itself
Discover every use of cryptography in an organisation
Select replacement algorithms or generate a complete migration roadmap
Certify security, compliance or PQC readiness

A complete organisational assessment may also require application analysis, source-code review, cloud and vendor information, business context, data lifetime, ownership, migration constraints and additional discovery methods. qReflector helps structure an important first technical layer.

Results reflect the evidence available in the uploaded report. Risk labels — including Q-Safe — describe detected cryptographic evidence; they are not a complete security assessment or a certification of security, compliance or PQC readiness. qReflector records accepted-risk decisions; the decision itself stays with your team. CycloneDX CBOM compatibility with a specific external platform should be confirmed by an integration test.

A practical first step into PQC readiness

Migration planning begins with visibility: where current cryptography is used, which hosts and services depend on it, and which configurations are already weak today. qReflector establishes that first technical baseline from scans you already run.

Deployment and security

A dedicated EU-hosted environment

qReflector runs as a hosted application in the EU. Each customer receives a separately provisioned environment.

Isolated customer environments

Environments are separated from one another, with access limited to the users defined for each.

ISO 27001

qReflector is built and operated by ITS a.s., whose company management system is certified to ISO 27001.

Details on hosting, isolation and access are on the Trust & Security page.

See what your vulnerability reports already know about cryptography

Turn an existing Nessus, OpenVAS or Qualys report into a structured view of hosts, services and detected cryptographic findings.

Request access Ask a product question

1 Request access by e-mail 2 Environment provisioned and access sent within 1 business day 3 First review with your own report

Explore the PQC Learning Hub