The quantum-resistant cloud, for building security resilience. Scan, host and prove your software against the quantum threat, before it ships, not after.
Sentinel is the quantum-resistant layer of the KXCO cloud. Bastion finds the breakable, quantum-vulnerable cryptography hiding in your code, dependencies and live endpoints, paste a URL or a repo, and hands you the exact fix; PQC Host ships every deploy quantum-proof, with an ML-DSA-65 signature anyone can verify. Post-quantum by default, not a migration bolted on later.
One product, three modules. Bastion finds and fixes the breakable cryptography across twenty-three target kinds. PQC Host refuses a critical deploy and signs the release. Agent Certainty scores an agent on nine dimensions of governance before it acts. Every report is signed with ML-DSA-65 and checkable at pqc.kxco.ai/verify, no account, no call.
Connect a repository and Bastion carries it through seven stages: detect the breakable cryptography, score it, generate the post-quantum fix, and seal the result with a signature anyone can verify, then keep watching.
The RSA and ECC sitting in most software stacks is exactly what a cryptographically relevant quantum computer is expected to break. It rides along into production every time you deploy, and "we'll deal with it later" means shipping the exposure today and discovering it under a deadline later.
Existing hosting and scanning platforms don't fix that. They surface findings, generate a PDF, and walk away, no fix, no proof, and no way for a third party to confirm anything was actually done. None of them make the cloud itself quantum-resistant.
What's missing isn't another report. It's a cloud that catches the weakness before deploy, applies the post-quantum fix, and hands anyone a proof they can check themselves.
Bastion traces every dependency down to the cryptographic primitive it uses, and lights up what a quantum computer can break. Hover a node to isolate its relationships; run the scan to trace the path from repo to risk.
Illustrative dependency graph. A Node.js repository, checkout-service on branch main, with 3 critical findings, depends on four packages: jsonwebtoken 8.5.1 (auth tokens), node-forge 0.10.0 (TLS and PKI), openssl-wrapper 1.1.1w (transport), and @kxco/pqc 1.0.0 (post-quantum). Those packages use five cryptographic primitives. Three are quantum-vulnerable or weak: RSA-2048, a signature and KEM primitive whose post-quantum fix is ML-KEM-768; ECDSA-P256, a signature primitive whose post-quantum fix is ML-DSA-65; and SHA-1, a deprecated hash whose fix is SHA-3-256. AES-256-GCM remains classically secure. The @kxco/pqc package provides the two post-quantum replacements, ML-KEM-768 (NIST FIPS 203, key encapsulation) and ML-DSA-65 (NIST FIPS 204, signature), which replace RSA-2048 and ECDSA-P256 respectively.
A scan or deployment isn't a report you have to take on faith, it's a signed manifest. Follow how a build becomes a proof any third party can verify, with no access to KXCO.
Illustrative chain of proof. Build and Deploy takes a commit and source and runs the Bastion pre-deploy scan, producing a Deployment Manifest that binds the commit SHA, timestamp, scan result and live URL. That manifest is signed by an ML-DSA-65 signature (NIST FIPS 204). The signature is presented to any verifier, who needs only the Published Public Key at /.well-known/kxco-pq-pubkey, which is open and requires no account. Verification yields a Verifiable Proof that is tamper-evident and requires no trust in KXCO.
Two products, one job: find the weak cryptography and prove it's gone. Here's how each stacks up against the tools you already know.
| Feature | Enterprise scanners | KXCO Bastion |
|---|---|---|
| Setup required | SPAN port + Linux LD_PRELOAD agent | Zero, paste any file or URL |
| Time to first result | Infrastructure deployment required | Under 10 seconds |
| Detects RSA / ECC / SHA-1 / weak TLS | ✓ | ✓ eight language ecosystems |
| Dockerfile / Terraform / Kubernetes | Not documented natively | ✓ all three, zero setup |
| CBOM export | ✓ (2 specific generators only) | ✓ CycloneDX 1.6, ML-DSA-65 signed |
| Migration code per finding | Impact simulation dashboard | ✓ Before/after code + npm commands |
| Proof of assessment | Proprietary control plane | ✓ ML-DSA-65, independently verifiable |
| PQ-native standards | PQ migration on classical stack | ✓ NIST FIPS 203/204 from day one |
| Feature | Vercel / Netlify / Fly | KXCO Cloud |
|---|---|---|
| Static + Node.js hosting | ✓ | ✓ |
| GitHub auto-deploy | ✓ | ✓ |
| Free TLS | ✓ | ✓ |
| Pre-deploy security scan | Some | ✓ KXCO Bastion |
| Quantum-vulnerability detection | ✗ | ✓ |
| ML-DSA-65 deployment attestation | ✗ | ✓ |
| Independently verifiable proof | ✗ | ✓ |
Every signature roots to a single post-quantum key, published openly at a well-known address. See how signing authority is delegated, and why verification needs nothing but that public key.
Illustrative signing-authority tree. The KXCO Root Authority uses ML-DSA-65 and is held in offline custody. It delegates to a Platform Signing Key, which is rotated on a schedule. That platform key signs three things: the Scan Report Signature covering every Bastion report, the Deployment Signature covering every PQC Host deploy, and the CBOM Signature covering the CycloneDX 1.6 export. All three are verified by the Published Public Key at /.well-known/kxco-pq-pubkey, which any third party can check using the public key alone.
Two products, both live on the KXCO Cloud platform.
Sentinel's capabilities line up against the post-quantum standards and government mandates. Hover a capability or a framework to see what connects to what.
Illustrative standards map. KXCO Sentinel, the quantum-resistant cloud, implements four capabilities: Crypto Detection (finds RSA, ECC, SHA-1 and TLS weaknesses), PQ Remediation (applies ML-KEM and ML-DSA fixes), ML-DSA-65 Attestation (emits signed, verifiable proof), and CBOM Export (CycloneDX 1.6 format). These align to six standards and mandates. PQ Remediation aligns to NIST FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA). Attestation aligns to FIPS 204, to the NSA's CNSA 2.0 (2030 deadline) and to NSM-10 (US Federal, 2035 deadline). Crypto Detection aligns to CNSA 2.0 and NSM-10. CBOM Export aligns to the CycloneDX CBOM standard.
Sentinel serves teams that need to find, fix and evidence quantum-vulnerable cryptography, for auditors, regulators, or their own peace of mind.
The questions we hear most, answered straight.
/.well-known/kxco-pq-pubkey, with no account and no connection to KXCO required. The proof is mathematical, so it stands on its own and cannot be quietly rewritten.The group, the filed entity, the counsel and the mathematics are on this page so a counterpart doesn't have to ask.
The same identity, authority and signature layer carries the deals, the money and the agents.
Working groups first. Developer programmes are memberships, and are named as such.
| Association | Status | Check |
|---|---|---|
| PKI Consortium | Member: Knightsbridge Financial Ltd. Working groups PQC, CBOM, CM, PKIMM, TCWG | pkic.org/members → |
| Cloud Security Alliance | Quantum-Safe Security Working Group, member | CSA working group → |
| DIF / Linux Foundation | Contributor member M-018609, to 26 August 2027 | identity.foundation → |
| CoSAI / OASIS Open | Open Project participant, from 26 August 2026 | coalitionforsecureai.org → |
| IETF LAMPS WG | Participant. Post-quantum X.509 certificate work | IETF datatracker → |
| NIST FIPS 203 / 204 / 205 | Implemented in production: ML-KEM-768, ML-DSA-65, SLH-DSA. ACVTS credentials active. Implemented, not endorsed | NIST FIPS 204 → |
| IBM Quantum Network | Member. Programme membership, not a joint venture | IBM Quantum Network → |
| NVIDIA Developer Program | Member | developer.nvidia.com → |
| Visa Developer Program | Member | developer.visa.com → |
| xAI Developer Program | Member | x.ai → |
Aligned to NSA CNSA 2.0 and the US federal 2035 path. Further developer-programme memberships are listed on the company page.
No account, and no call to us.
Sentinel scans your code, containers, AI agents and MCP servers for quantum-vulnerable cryptography and agent-trust risks, returning a signed report you can hand to an auditor. Or talk to us about quantum-resistant hosting and Bastion in your CI/CD pipeline. New: read why BlackRock's quantum warning makes post-quantum an infrastructure requirement.