SCANOSS detailed new capabilities within Earnie, its code governance solution, to address a critical blind spot for organizations preparing for quantum computing. Most enterprises, according to SCANOSS Chief Product Officer Matias D’Aloia, “can’t see much of it,” referring to the cryptographic algorithms embedded within their codebases.
Earnie creates a structured Cryptography Bill of Materials (CBOM), mirroring the widely adopted Software Bill of Materials, and flags algorithms like RSA and ECDH as quantum-vulnerable, assigning a severity rating to prioritize remediation efforts. This continuous inventory, SCANOSS reports, traces cryptographic reachability and provides a standing record of an organization’s cryptographic estate.
Earnie Delivers Continuous Cryptographic Inventory with CBOM
Earnie, SCANOSS’s code governance solution, identifies over 120 cryptographic algorithms within a codebase and its dependencies, providing a level of detail previously unavailable to many organizations. This reachability analysis distinguishes Earnie from simple static lists, allowing teams to prioritize remediation efforts based on actual usage rather than potential presence. The CBOM produced by Earnie includes a severity rating for each identified algorithm, drawn from SCANOSS’s curated assessment tables, specifically flagging those vulnerable to quantum computing attacks.
This prioritization is critical because organizations preparing for the shift to post-quantum cryptography require more than just an inventory. They need evidence to guide migration efforts. “You cannot migrate crypto you cannot see, and most organizations can’t see much of it,” explains Matias D’Aloia, Chief Product Officer at SCANOSS.
The system’s continuous scanning, performed on every commit and pull request, ensures the cryptographic inventory remains current, automatically identifying new, resolved, or re-detected findings as code evolves. Beyond post-quantum readiness, Earnie’s inventory also supports export control compliance. The system generates an export-control evidence report alongside each CBOM, providing trade-compliance teams with the factual basis for self-classification, without making a legal determination. Findings within Earnie are deterministic, meaning the same code will always produce the same result, a feature designed to ensure the resulting record is defensible during audits or regulatory reviews.
This consistency is maintained because detection runs inside the customer’s own environment, whether SCANOSS hosts it or the customer manages it on-premises, and source code never leaves that environment. A key differentiator is the system’s ability to discern whether a cryptographic asset is actually used, rather than simply present in a dependency.
Where the analysis cannot definitively determine reachability, Earnie explicitly states so, avoiding potentially misleading assumptions, SCANOSS says. SCANOSS reports that this policy-and-evidence model is applied across all domains of Earnie’s governance capabilities, connecting each finding to a decision and recording the supporting evidence. The cryptography and post-quantum readiness capabilities are available now as part of Earnie, with full details accessible at earnie.dev.
See today’s quantum computing news on Quantum Zeitgeist for the latest breakthroughs in qubits, hardware, algorithms, and industry deals.
