Post-Quantum Readiness
Requires Runtime Truth.
Laviq helps security teams find shadow cryptography in live Linux systems, validate what actually executes at runtime, and prioritize remediation for PQC audits and migration planning. No source code required.
USA: NSA CNSA 2.0
The Hard Deadline
National Security Systems must begin the transition to Quantum-Resistant algorithms by 2025. You must prove your inventory down to the runtime layer.
Canada: ITSM.40.001
The Inventory Mandate
Federal departments need a complete cryptographic inventory and migration plan by April 2026. Laviq maps your "Black Box" vendor binaries running in production.
Global Standard
"Store Now, Decrypt Later"
Protecting long-term data requires immediate action. Laviq captures the exact TLS network parameters being negotiated live to stop vulnerable traffic.
Static inventory is not runtime truth.
See why SBOMs and configs fail audits, and how Laviq's Runtime Truth Engine captures what actually executes in memory.
tls_settings:
min_version: "TLS 1.3"
ciphers:
- "TLS_AES_256_GCM_SHA384"
fallback_allowed: true
The configuration file dictates modern TLS. An auditor reviewing the config assumes the system is compliant.
"laviq_event": "tls_handshake",
"pid": 4092,
"negotiated_version": "TLS 1.2",
"cipher_suite": "TLS_RSA_WITH_AES_128...",
"verdict": "CLASSICAL_FALLBACK"
}
Laviq captures the live connection falling back to a classical path. Support in code is not selection in production.
Runtime evidence from the host.
Not guesses from the repo. Laviq shows what cryptography actually executes at runtime so teams can identify shadow crypto, assign ownership, and prioritize PQC remediation.
Deep Runtime Context
A naive list of loaded libraries isn't enough to prove risk. Laviq's Runtime Truth Engine captures the entire execution chain. We map the process tree, track the network trigger, capture the exact cryptographic parameters, and provide the userspace backtrace to pinpoint the exact line of execution.
- Full process hierarchy mapping
- Network & Crypto event correlation
- Exact parameter capture (e.g., Key Size)
- Userspace stack traces for precise attribution
PQC Remediation Roadmap
Audit: ITSM.40.001Actionable Migration Plans
Runtime findings become actionable only when they include ownership, blast radius, and a concrete next step. This roadmap is designed to show engineering and security teams what to fix first, who should fix it, and how closure is verified.
- Tie each runtime finding to a PQC migration concern
- Surface owner and blast radius before change execution
- Close the loop with verification states and planned rescans
Frictionless, Air-Gapped Deployment
Security tools shouldn't break your production servers or require opening firewall ports. Laviq is distributed as a standalone .deb, .rpm, or Docker container. It is 100% offline-first. Your proprietary binaries and cryptographic evidence never leave your environment.
- Zero external cloud connections required
- Native package managers or container execution
- Non-intrusive kernel memory hooks (No reboots)
Officially Supported Environments
Requires Linux Kernel 5.10+ (eBPF capabilities)
Deployment Options
Transparent by Design.
Cryptographic risk scoring shouldn't be a black box. While our Runtime Truth Engine is commercial, we open-source our HTML Reporter UI and the Trust Matrix scoring logic. Security teams can audit our math, modify the output formats, and trust the methodology behind every PQC finding.
Offline-First Security Analysis
All analysis is performed offline, in a controlled environment.
Your binaries never leave your environment
Start with scoped deployments and controlled environments before expanding into broader production coverage.
Analyze as-is without recompilation
Minimal resource usage, non-intrusive no reboots required.
Frequently Asked Questions
Request a PQC Discovery Pilot
Discuss a controlled assessment for your Linux estate.