See your bank’scryptographic posture

From a single handshake to the whole estate.

DRISHTI-PQC scans live TLS endpoints - not source code - so everything it reports is the cryptography actually negotiated in production. A quick scan grades one host in seconds; organise hosts into banks and the platform rolls the same evidence up into estate-wide posture, a quantum-migration map, and a single ranked backlog. Every number traces back to a real, observed handshake.

An A+ to F grade, the way the industry reads it.

DRISHTI-PQC scores each host the way a Qualys- or SSL Labs-style report does, weighing protocol support, key exchange and cipher strength into a single letter your leadership already understands. No interpretation needed: a grade, four sub-scores, and the reasons behind it.

A full A+ through F scale — strongest to weakest — with four sub-scores behind every letter.

Protocol-level detail, not just a score.

Look past the grade and the full handshake is laid out - the SSLv3–TLS 1.3 protocol matrix, the per-version cipher list with forward-secrecy and strength flags, secure renegotiation, session resumption, OCSP stapling, HSTS, the negotiated key-exchange group, and the certificate's serial, fingerprint, key type and full SAN list. Each value is observed from a real handshake, never assumed.

Every weakness, named - with the fix.

A deterministic findings engine turns what was observed into a clear list: severity, the CVE where one genuinely applies, and the remediation step. What can't be checked without an active exploit probe is marked “not assessed” - honestly, never guessed.

Ready for the threat that hasn’t arrived yet.

DRISHTI-PQC detects post-quantum key exchange - ML-KEM and hybrid groups - so you can see, asset by asset, where the bank already stands against “harvest-now, decrypt-later.” It is the same lens behind PNB's readiness benchmarking.

Every host placed on the NIST IR 8547 journey.

A grade says how strong a host is today; a phase says where it sits in the quantum migration and what single step moves it forward. DRISHTI-PQC classifies each asset into one of five phases from real handshake fields - and rolls them into a bank-wide waterfall with a readiness percentage. Two hosts that both read “not PQC” can be a config flip apart or a new-appliance apart; the phase tells them apart.

Proof the estate is actually moving.

Every scan into a bank is captured automatically, so posture builds its own history. Change-tracking shows a score-over-time trend, a “what changed since last scan” delta feed, and a per-asset movement trail - every grade promotion or demotion and every PQC-readiness flip, with the host named and dated. When a host crosses into hybrid key exchange it's recorded as “became PQC-ready”; if it slips back, that's recorded too. It's the dated, screenshot-ready evidence of progress for leadership.

A CBOM built from production, not from source.

A machine-readable inventory of every cryptographic asset in use - algorithms, protocols, certificates and keys - flagging which are quantum-vulnerable, when they break, and what to replace them with. Because DRISHTI-PQC reads live endpoints, this CBOM records the cryptography genuinely negotiated across the bank's real estate: the more credible artifact for a regulator than anything a source-code scanner can produce.

One question per tool. One estate, unified.

Each tool answers a focused question about a domain or a host. The Attack Surface console unifies every finding across every bank into one posture, one phase map and one prioritised backlog.

One clean record per asset, always current.

Organise hosts by bank and rescan whenever you need. Each asset keeps a single entry that always reflects its latest scan - so the inventory stays the source of truth, never a pile of duplicates - while an append-only history quietly preserves every past scan for the trend and movement trails.