Tessera PQC
PX-04
From inventory to migration
Discovery is where most tools stop.
Tessera PQC runs the whole programme — the inventory, the ranking, the migration plan, the re-test and the evidence — with the governance a bank's risk and audit functions expect.
01
04
What a scanner on its own will not do.
Not just your own code
The cryptography inside vendor products.
Most of a bank's cryptography sits in core-banking and payment products delivered as compiled files, and in HSMs and cloud key stores. Tessera PQC reads compiled applications and images without source, inventories key stores by type and size only, imports signed vendor CBOMs, and names the vendor — or the Aadhaar, UPI or eSign scheme operator — as the owner who has to change it.
compiled apps · images · HSM and KMS metadata · vendor CBOMs
Governed like a bank works
Nothing touches the network on one person's say-so.
Every engagement carries a written authorisation and dates. Scope is default-deny for paths, hosts, domains and IP ranges, every probe of a live endpoint waits for a second person, and endpoint checks send a single hello with no login. Every action is written to a hash-chained, append-only audit trail.
default-deny scope · two-person approval · hash-chained audit
Evidence, not a spreadsheet
Scored per regulation. Signed twice.
Each control in the DST roadmap, RBI, CERT-In, PCI DSS 12.3.3, DORA and NIST profiles is evaluated from live evidence in the engagement. The evidence pack — report, CBOM, findings, tasks, tests and audit trail — is signed with Ed25519 and ML-DSA-65, so it stays verifiable after a quantum computer could forge a classical signature.
DST · RBI · CERT-In · PCI DSS · DORA · NIST IR 8547
02
04
The platform, screen by screen.
08 SCREENS · CLICKTAP TO ENLARGE
pqc-demo.par2labs.com
01 / 08
01
Dashboard
One screen for the CISO: readiness, open findings by severity, endpoints already offering hybrid key exchange, and what is waiting for approval.
A readiness score weighted by severity, with the trend over the last 30 days.
Findings by algorithm family, by source and by asset kind.
Jobs pending approval, targets refused by scope and audit events, at a glance.
03
04
Six stages, one engine
01
Govern
Engagements with written authorisation and dates, a default-deny scope, two-person approval before any network probe, and roles from admin to auditor with MFA.
02
Discover
Code, compiled vendor applications, container images, keystores, HSMs, cloud KMS, certificates and live endpoints, in one inventory.
03
Prioritise
Every asset scored on data shelf life, exposure, effort and the deadline that applies, against recognised industry frameworks.
04
Migrate
Tasks generated from findings, planned in waves with owners and due dates; sign-off before done, and risk acceptance that expires.
05
Test
Hybrid TLS re-tests per endpoint after a change, and ML-KEM and ML-DSA tests on your own libraries and hosts.
06
Prove
Control status per regulation, CBOM, SARIF and PCI 12.3.3 exports, a hash-chained audit trail and a signed evidence pack.
04
04
What banks use it for.
01
Produce the cryptographic inventory the DST roadmap asks critical sectors for by December 2027.
02
Find the quantum-vulnerable cryptography inside a vendor's core-banking delivery, without its source code.
03
Answer PCI DSS 12.3.3 with a reviewed cipher and protocol inventory instead of a spreadsheet.
04
Rank thousands of findings into a migration plan with owners, waves and due dates.
05
Prove an endpoint now offers hybrid X25519MLKEM768 key exchange after a change.
06
Hand the auditor a signed evidence pack and a hash-chained audit trail.
07
Block new weak cryptography at merge time in your CI pipelines.
08
Ask vendors for signed CBOMs, verify them, and produce your own for the products you sell.