Q-Shield · compared

Where Q-Shield fits.

Three kinds of tools answer "are we ready for post-quantum cryptography?" Free checkers test a website. Enterprise platforms inventory cryptography across a whole estate. Q-Shield scans the servers you approve (web, mail, VPN, databases and SSH), judges them against NIST IR 8547 or the NSA's CNSA 2.0, ranks what to fix first, and hands your auditor a report they can verify without us.

Every fact about another product below comes from that vendor's own pages, checked in November 2026; the numbers link to them. IBM is EpochCore's partner (IBM Business Partner), and IBM Quantum Safe is IBM's enterprise offering.

Free checkers

A quick look at one website.

Free checkers test whether a public site negotiates a post-quantum key exchange. None of the three says it tests for ML-KEM-1024, the key exchange CNSA 2.0 requires.

	DigiCert PQC Checker	Wiz PQC Tester	Axiad PQC Readiness Tester	Q-Shield
Cost	Free ¹	Free ⁵	Free scan, no signup; the full report needs a work email at the scanned company ⁸	Free for the three design partners; then $2,500 for a one-time report of up to 25 hosts
Connects to	A website or IP address, over TLS ¹	A domain over HTTPS on port 443 ⁴	Internet-facing hosts found through passive DNS and certificate transparency; TLS on each host, and mail transport in its sample report ⁹	The hosts you approve in writing: TLS on any port, SMTP, IMAP, POP3 and PostgreSQL after STARTTLS, SSH, and the front page's headers on HTTPS
Tells you	Pass or fail on TLS 1.3 and post-quantum groups ²	TLS 1.3 support, and whether post-quantum groups such as X25519MLKEM768 are supported ⁴	Compliant or not, TLS version, algorithms, a harvest-now-decrypt-later verdict and a ranked roadmap (behind the email step) ⁷ ⁹	A verdict for every check, a plan ranked by how sensitive each host's data is and how long it must stay secret, with dates
Evidence	No report; planning is in DigiCert Quantum Central ³	No report ⁴	A report, behind the email step ⁹	A PDF, signed JSON and a CBOM, signed with Ed25519 and ML-DSA-87; an auditor checks them offline with OpenSSL
CNSA 2.0	Not mentioned ¹	Not mentioned ⁴	CNSA 2.0 rows in its report; its coverage note says it checks for X25519MLKEM768 only ⁹	A CNSA-2.0-only hello (ML-KEM-1024 and its P-384 hybrid) to every TLS host, and its own profile

Wiz also offers its customers a separate product, Wiz for PQC Readiness, which builds a cryptography inventory across cloud and code without agents and helps produce a CBOM ⁶.

Enterprise platforms

Cryptography across a whole estate.

Enterprise platforms find cryptography with sensors, agents, network capture, code scanning and integrations, and manage it from there. None of the four lists a price.

	IBM Quantum Safe	SandboxAQ AQtive Guard	Keyfactor AgileSec	AppViewX AVX	Q-Shield
Finds cryptography by	Cryptography Manager covers IT operations and code repositories; built-in discovery uses Nmap and Kubernetes, with imports from Vault PKI, Qualys, Tenable Nessus, CSV and a REST API. Explorer reads source code and configurations ¹¹ ¹³	Sensors (filesystem and container images, a Java tracer, a network analyzer for TLS handshakes) and feeds from AWS, CrowdStrike, Palo Alto, Qualys, SentinelOne and ServiceNow ¹⁵	Sensors on code, servers, endpoints, cloud workloads and network traffic, or existing EDR and vulnerability tools ¹⁷	Agentless discovery of certificates, TLS settings, cipher suites, protocols and code libraries; reuses Tenable and Qualys scans ¹⁹ ²⁰	A scan from EpochCore's server of the hosts you approve, the signed collector inside your network, or the command line; a GitHub app reads lock files
You get	Inventory, CBOMs, risk scoring, policy compliance, a roadmap, workflows and Jira or ServiceNow tickets; IBM Quantum Safe Proxy adds hybrid post-quantum cryptography without code changes ¹¹ ¹²	An exportable inventory, issues ranked by severity with fixes, NIST and post-quantum profiles ¹⁵	Inventory with risk context, prioritization, NIST and PCI DSS checks, rotation and renewal workflows, CBOM export ¹⁷ ¹⁸	An automatic CBOM, readiness scoring with CMDB context, ServiceNow tickets, post-quantum and hybrid certificates ¹⁹	Verdicts under NIST IR 8547 or CNSA 2.0, a dated plan ranked by your data, a signed report and CBOM, and a weekly re-check that emails when a verdict changes
How you buy	90-day free trial; buy from IBM or AWS Marketplace ¹¹	Contact sales ¹⁶	Request a demo ¹⁷	Custom quote ¹⁹	Free for the three design partners; then $2,500 per 25-host report and $300 to $500 a month for the weekly re-check
Runs	On Kubernetes or OpenShift ¹⁴	SaaS ¹⁵	SaaS hosted by Keyfactor, or self-hosted ¹⁷	SaaS, private cloud, hybrid or on-premises ¹⁹	Hosted by EpochCore, as a signed Docker image in your network, or from the command line

What Q-Shield doesn't do (yet)

The first scan and the auditor's evidence. Not a full platform.

No agents on your machines. The collector covers what can't be reached from outside, from inside your network.
No certificate lifecycle management. If you need it, pair Q-Shield with your certificate management platform.
No ticketing or SIEM integrations yet. Changes reach you by email, and by Slack if you add a link.
No SOC 2 report yet, and an early-stage company. The verifier is open source, and every report checks without us.

Become a design partner What Q-Shield does

Sources

A quick look at one website.

Cryptography across a whole estate.

The first scan and the auditor's evidence. Not a full platform.

The vendors' own pages, checked November 2026.