Proof, not posture.

You cannot migrate cryptography you cannot see.

Every institution knows it will have to move to post-quantum cryptography. Almost none can answer the first question a regulator will ask. That inventory does not exist, because no scanner has ever produced it — they look for vulnerabilities, not for cryptography.

0dq scores six pillars as one number with the arithmetic shown: quantum readiness at 30%, then code, dependencies, secrets, infrastructure and licences. Five of those you already have from other tools. The first one you do not, and it is the one a post-quantum programme starts with.

Findings carry a reachability verdict — called, not called, dead code, dev only — so the list is ordered by what can actually run rather than by severity alone. Where a fix is mechanical, it opens the pull request. Point it at a repository and it answers in minutes: no agent, no integration project.

• NIST published ML-KEM, ML-DSA and SLH-DSA in August 2024. What to migrate to is no longer an open question — only what to migrate, and in what order.

  NISTThird-party, published

• Cryptography and key management are already named control domains under the CBUAE Information Security Regulation and Operational Risk Standard.

  CBUAEThird-party, published

• Six pillars, weighted into one score: quantum readiness 30%, code 18%, dependencies 17%, secrets 13%, infrastructure 12%, licences 10%.

  0dq scoring modelProduct behaviour

• Static analysis runs 2,452 rules across OWASP Top Ten and CWE Top 25. Secrets are found in commit history, not only the working tree.

  0dq scannerProduct behaviour

• Every finding carries a reachability verdict — called, not called, dead code, dev only — so the queue is ordered by what can run, not by severity alone.

  0dq findings viewProduct behaviour

• Runs in the browser, on the command line, as a pipeline gate, and as a pre-commit hook that stops a credential locally in under a second.

  0dq surfacesProduct behaviour

The board will ask if your team is crisis-ready. Will you have proof?

Traditional tabletop exercises leave nothing measurable behind. A facilitated discussion around a conference table produces no timestamped decisions, no response quality data, and nothing an auditor can reference.

Aegix replaces it with a live, AI-generated simulation where participants face timed, role-based decisions under pressure. Every choice is captured, every response graded, and every outcome mapped to the frameworks that ask for evidence of operational resilience testing.

What comes out is not a lessons-learned note. It is a readiness grade, a timestamped decision log, and an incident response playbook with role assignments, escalation paths and communication templates — internal, external and regulatory — generated from what your team actually did, and mapped to NIST SP 800-61, ISO 27035 and SANS.

• Designed for 100–150 participants. An extrapolation from the 50-participant run, not a measured figure.

  Our own load testing notes, extrapolated from the 16 November 2025 runProjected, not measured

• A full scenario is generated in usually two to five minutes.

  Stated on the Aegix generation screenProduct behaviour

• Participants join by QR code. No app, no login.

  The Aegix participant join flowProduct behaviour

• Each session generates an incident response playbook: role assignments, escalation paths, timelines, and communication templates for internal, external and regulatory audiences.

  Aegix playbook generatorProduct behaviour

• Findings are mapped to NIST SP 800-61, ISO 27035 and SANS for the response plan, and to NIST CSF, DORA, ISO 22301 and CBUAE for the compliance record.

  Aegix framework mappingProduct behaviour

Assume the ransomware gets administrator.

Attackers take administrator before they encrypt anything, because at that level most security tools can be switched off and most copies can be deleted. Backups are hunted first, for the same reason: a customer who can restore does not pay.

RX9 is built for that move specifically. Files are preserved before they are damaged, and releasing them takes an approval from your console — which nobody sitting at the compromised machine can grant, and nothing running on it can either, including whatever the attacker brought with them.

• Attackers went after the backups of 94% of ransomware victims, and succeeded against more than half.

  Sophos, State of Ransomware 2025Third-party, published

• Median time from initial access to the domain controller: 3.4 hours.

  Sophos, Active Adversary Report 2026Third-party, published

A security score tells you where an asset stands. Not that it just moved.

Security assessments for digital assets exist, and they are good. But they are a snapshot you go and look up, one asset at a time, when somebody remembers to check. Posture decays quietly — development stalls, governance concentrates, liquidity thins, an audit goes stale — and by the time it shows in the price it is late.

CipherScan scores every listed asset hourly across six categories, evaluates it against thresholds you set, and raises one alert per condition, held open while it persists. No custody, no wallet connection, no keys. Analysis only.

It also answers the question that arrives months later: why was this asset listed, and on what basis. A decision record reconstructs the evidence as it stood on the listing date — and says plainly whether that is a snapshot taken at the time, a reconstruction from surviving data, or not establishable at all. Anyone listing assets has to answer that eventually; most cannot.

• No custody, no wallet connection, no keys, no signatures, and no holdings recorded. Analysis only.

  CipherScan product behaviourProduct behaviour

• One alert per condition, held open while it persists — rather than one per evaluation. An inbox you still read in month six.

  CipherScan alerting behaviourProduct behaviour

• A listing decision record states the evidence as at the listing date, and labels its own basis: a snapshot recorded at the time, a reconstruction from surviving data, or unavailable. The three are never presented as one.

  CipherScan listing decisionsProduct behaviour