Skip to main content
FOR REGULATED ENTERPRISE & FEDERAL CONTRACTORS

Plan Cryptographic Migration & Compliance Across Your Enterprise Fleet

Deploy inside private VPCs or air-gapped networks with zero outbound connections. Automatically locate legacy cryptography, validate code fixes locally, and produce signed CycloneDX 1.6 CBOM and compliance reports ahead of the January 1, 2027 CNSA 2.0 procurement gate.

Download Free Signed CLI (.zip)2-Page Enterprise Order Form & Zero-Egress EULAOMB M-23-02 & CNSA 2.0 Mandate Briefing
Federal & Defense Ready

OMB M-23-02 & CNSA 2.0

Satisfy active 2025–2026 automated CBOM inventory mandates and the Jan 1, 2027 CNSA 2.0 acquisition gate with deterministic file, bytecode, and keystore provenance.

Zero-Egress Architecture

No DPA / No Cloud Subprocessors

Because 0 bytes of source code or PII leave your environment, InfoSec and VRM reviews complete in days using our Standard 2-Page Order Form and Zero-Egress EULA.

Zero Hidden Fees Pledge

100% All-Inclusive Fleet Licensing

Flat annual licensing ($9,999 / $24,999 / $49,999/yr) with $0 per-developer seat tax, $0 token/Byte-upload fees, and $0 mandatory professional services tax.

VERIFIED US FEDERAL & ENTERPRISE PQC MANDATE TIMELINE

NSA CNSA 2.0, OMB M-23-02, Public Law 117-260 & NIST IR 8547 Cutoffs

Waiting for 2030 is a procurement trap. Automated CBOM discovery under OMB M-23-02 is active right now, and the January 1, 2027 NSA CNSA 2.0 acquisition gate blocks non-compliant software from federal and defense supply chains.

2025–2026ACTIVE NOW

OMB M-23-02 · Public Law 117-260 · NSA CNSA 2.0 Phase 1

Mandatory Automated Cryptographic Discovery, CBOM Inventory & CNSA 2.0 Phase 1

Federal agencies, defense industrial base contractors, and regulated suppliers must maintain automated cryptographic inventories (CBOM) of quantum-vulnerable systems. Under NSA CNSA 2.0 Phase 1, Software & Firmware Signing (LMS/XMSS, ML-DSA), Web Browsers/Cloud (ML-KEM-1024 hybrid TLS), and Networking Equipment (2026) must Support & Prefer CNSA 2.0 algorithms.

  • Automated annual CBOM inventory across High-Value Assets (OMB M-23-02 & Public Law 117-260)
  • Software & Firmware Signing: Support & Prefer LMS/XMSS and ML-DSA (FIPS 204)
  • Web/Cloud TLS & Networking (2026): Support & Prefer ML-KEM-1024 (FIPS 203) hybrid key establishment
January 1, 2027IMMEDIATE ENTERPRISE BLOCKER

NSA CNSA 2.0 Acquisition Gate

All New NSS & Federal Supply-Chain Acquisitions Must Be CNSA 2.0 Compliant by Default

Starting January 1, 2027, all new COTS software and system acquisitions for National Security Systems (NSS) and federal/defense supply chains must ship CNSA 2.0 compliant cryptography by default unless a formal waiver is granted.

  • Vendor CBOM attestation required prior to procurement approval
  • ML-KEM-1024, ML-DSA-87 / ML-DSA-65, and SHA-384/SHA-512 enforcement
  • Elimination of uninventoried RSA-2048, ECDSA P-256, and legacy PKCS#12/JKS keystores in shipped artifacts
December 31, 2030DEPRECATION CUTOFF

NIST IR 8547 & CNSA 2.0 Exclusive Use / Deprecation Cutoff

Classical RSA-2048, ECDH & ECDSA Deprecated Across HVAs; Exclusive CNSA 2.0 Enforcement

Under NIST IR 8547 and NSA CNSA 2.0, classical 112-bit security public-key algorithms (RSA-2048, ECDH, ECDSA) are officially deprecated across Federal High-Value Assets and disallowed for CNSA 2.0 Software/Firmware Signing and Networking.

  • RSA-2048, Diffie-Hellman, ECDH, and ECDSA deprecated under NIST IR 8547
  • Exclusive CNSA 2.0 post-quantum enforcement for Software/Firmware Signing & Networking
  • Zero tolerance for legacy TLS 1.2 static RSA or SHA-1/MD5 signature chains
December 31, 2031 – 2035COMPLETE DISALLOWANCE

NIST IR 8547 & NSM-10 Complete Disallowance

Legacy Quantum-Vulnerable Public-Key Cryptography Completely Disallowed

By 2031–2035 under NIST IR 8547 and National Security Memorandum 10 (NSM-10), legacy quantum-vulnerable public-key cryptography is completely disallowed across all federal, defense, and critical-infrastructure systems.

  • Complete disallowance of classical-only RSA, ECDSA, and ECDH under NIST IR 8547 (2035 cutoff)
  • Full CNSA 2.0 exclusive post-quantum posture across all NSS niches by 2031–2033
  • Continuous signed CycloneDX 1.6 CBOM & OpenVEX 0.2.0 regression gates enforced in CI/CD
ROI & ENGINEERING TIME CALCULATOR · US NATIONAL AVERAGE BENCHMARK

Estimate Your Monthly Manual Triage Cost vs. Automated Local Remediation

Application Security & Senior Software Engineers average $160,000/yr (~$80/hr) in the US before benefits, and multi-repository external PQC readiness assessments typically run $15,000–$75,000+ for static spreadsheets that never fix a single line of code.

25 repos

Scale from a single flagship service (1 repo) to a 250-repo enterprise fleet.

1 repo ($4,999 Sprint)250 repos
3 engineers

Anchored at $160,000/yr (~$80/hr · $13,333/mo) per engineer.

1 engineer20 engineers
450 findings

Includes deprecated RSA/ECDSA/SHA-1 call sites, JKS/PKCS#12 certs, and SQLi/XSS/path sinks.

50 findings5,000 findings
CipherMap Deterministic Savings Benchmark

At 232ms median local repo scan (verified across 832 benchmark repos with 0 crashes), CipherMap inventories all 25 repositories in ~5.8s and verifies fixes via T0/T1 compile-and-test sandboxed autofixes.

Monthly Engineering Bleed

$6,480/mo

~81 hrs/mo manual triage (@ $80/hr)

CipherMap Net Annual Savings

$130,261/yr

Includes avoiding ~$62,500 external audit

Recommended Flat-Rate License Tier

Team Fleet (Up to 25 Repos)

$9,999/yr

$4,999 Sprint 100% credited in 30 days

Zero Hidden Fees / 100% All-Inclusive Enterprise Pledge

$0

per-developer seat tax

Unlimited developer & CI/CD runner commits inside your licensed repository tier.

$0

token/Byte-upload fees

100% local deterministic AST & bytecode engine—zero cloud token metering or per-line surcharges.

$0

mandatory professional services tax

White-glove CI/CD, GitHub Actions, and local MCP setup included with annual fleet plans.

Start with a 7-Day Free Pro Trial (100 CLI scans) or $4,999 Single-Repo Sprint
Explore Founding Partner Offer
UNFAKABLE TECHNICAL CASE STUDY & PROOF WALL

Four Verifiable Engineering Proofs You Can Audit Offline in Under 3 Minutes

No slideware, no cloud uploads, and no unverified AI patches. Every claim below is reproducible on your own workstation before you spend a dollar.

PROOF 01 · ZERO EXFILTRATION0 bytes of source code ever leave your machine

Air-Gapped Zero-Exfiltration Guarantee

Compiled as a standalone CGO_ENABLED=0 static binary running with --offline --no-telemetry. Verify zero outbound sockets yourself under strace, Little Snitch, or inside an air-gapped VPC runner.

  • CGO_ENABLED=0 static binary with SHA-256 checksums
  • --offline --no-telemetry enforced at runtime
  • 0 bytes of source code ever leave your machine
CGO_ENABLED=0 · ciphermap scan . --offline --no-telemetry
PROOF 02 · DETERMINISTIC SCALE232ms median scan time across 832 repositories · 0 parser crashes

Speed & Scale Proof

Benchmarked across 832 real-world multi-language repositories (Go, Rust, Python, TypeScript/JS, Java, C/C++, C#, Ruby, PHP, Swift) with 232ms median local scan latency and 0 parser crashes.

  • Go, Rust, Python, TypeScript/JS, Java, C/C++, C#, Ruby, PHP, Swift
  • Deep bytecode & keystore inspection (.jar, .war, .whl, JKS, PKCS#12, X.509)
  • Deterministic AST + call-graph reachability without LLM token variability
232ms median scan · 832 benchmark repos · 0 parser crashes
PROOF 03 · COMPILER-VERIFIED AUTOFIXT0/T1 broken-build isolation + 100% automatic rollback

Gate 1–4 Compile & Test Sandbox Proof

Every AST autofix is verified against your actual compiler/test suite inside an isolated worktree. T0/T1 broken-build isolation ensures that if a single unit test fails, CipherMap triggers a 100% automatic rollback.

  • T0/T1 broken-build isolation before any patch is proposed
  • 100% automatic rollback if a single test fails
  • Zero uncompiled regex replacements or hallucinated imports
Gate 1 AST → Gate 2 Build → Gate 3 Test Suite → Gate 4 Diff Sign-Off
PROOF 04 · DUAL-SIGNED EVIDENCEEd25519 + ML-DSA-65 (FIPS 204) CycloneDX 1.6 CBOM + CISA IBOM

Cryptographically Signed Audit Evidence

Every run emits a dual-signed (Ed25519 + ML-DSA-65 FIPS 204) CycloneDX 1.6 CBOM + CISA IBOM archival bundle ready for PCI-DSS 4.0, CNSA 2.0, CMMC 2.0, and FDA Section 524B assessors.

  • Dual-signed with classical Ed25519 and post-quantum ML-DSA-65 (FIPS 204)
  • CycloneDX 1.6 CBOM + CISA IBOM with file:line provenance
  • Mapped to PCI-DSS 4.0, CNSA 2.0, CMMC 2.0, and FDA Section 524B
Ed25519 + ML-DSA-65 (FIPS 204) · CycloneDX 1.6 CBOM + CISA IBOM
2-Minute Reproducible CLI Walkthrough (No Slides)

From Local Discovery to Signed CycloneDX 1.6 CBOM + Sandboxed Autofix

Download Offline Eval Pack (.zip)Inspect 832-Repo Benchmark Evidence
[00:00]Offline · 0 Bytes Sent

Step 1 — Air-Gapped Local Discovery (232ms Median)

$ ciphermap preflight . --offline --no-telemetry

Scans source, compiled .jar/.whl archives, X.509 certificates, and JKS/PKCS#12 keystores locally with 0 bytes uploaded.

[00:55]Offline · 0 Bytes Sent

Step 2 — Gate 1–4 Compile & Test Sandboxed Autofix

$ ciphermap fix . --verify-sandbox --offline

Applies deterministic AST migrations (e.g., RSA-2048/SHA-1 to ML-KEM/ML-DSA or parameterized SQL sinks) with T0/T1 broken-build isolation and 100% automatic rollback if any test fails.

[01:45]Offline · 0 Bytes Sent

Step 3 — Dual-Signed CycloneDX 1.6 CBOM + CISA IBOM

$ ciphermap report --format cyclonedx-1.6 --offline

Produces the Ed25519 + ML-DSA-65 (FIPS 204) signed audit binder for PCI-DSS 4.0, CNSA 2.0, SOC 2, CMMC 2.0, and FDA Section 524B assessors.