SCANOSS adds cryptography inventory and PQC readiness to Earnie

SCANOSS says its Earnie code governance platform now continuously inventories cryptographic assets, traces which ones are actually reached in code, and flags quantum-vulnerable algorithms to help enterprises prepare for post-quantum migration. The release also pairs each cryptography bill of materials with export-control evidence and runs entirely inside the customer’s own environment.

Why it matters: - Enterprises moving toward quantum-safe cryptography need a reliable inventory before they can migrate. - Earnie is designed to surface cryptographic algorithms hidden in dependencies, then rank what needs attention first. - The same inventory can support export-control documentation, giving compliance teams a factual basis for internal review.

What happened: - SCANOSS detailed the cryptography and post-quantum readiness features in Earnie, the major release of its code governance platform. - The platform publicly launched on October 6, 2026, at a live online event. - The new capabilities are available now as part of Earnie.

The details: - Earnie scans a codebase and its dependencies for cryptographic algorithms, protocols, certificates and key material. - The system produces a structured Cryptography Bill of Materials, or CBOM, using the same general model as an SBOM, but focused on cryptography. - Each finding includes a post-quantum status that flags quantum-vulnerable algorithms such as RSA or ECDH. - Each finding also gets a severity score from curated assessment tables published by Earnie. - Earnie traces reachability to show whether a cryptographic asset sits on a call path from an application entry point. - Reachable findings are shown hop by hop in a call trace. - If the analysis cannot determine reachability, Earnie marks the finding as undecided rather than guessing. - The platform scans continuously on every commit and pull request. - Each completed scan shows changes since the last full scan, including findings that are new, resolved, re-detected or still open. - Earnie produces an export-control evidence report alongside each CBOM. - The report is intended to support trade-compliance teams in their own self-classification. - The platform recognizes more than 120 cryptographic algorithms. - Detection runs inside the customer’s Earnie environment, whether SCANOSS hosts it or the customer runs it on-premises. - Source code never leaves that environment. - Findings are deterministic, so the same code produces the same result every time.

Between the lines: - The release shifts cryptography inventory from a one-time review to a continuous governance process. - Reachability analysis matters because not every discovered algorithm carries the same operational risk. - By separating evidence from decision-making, Earnie is built for audit and regulatory workflows as much as for engineering teams.

What's next: - PQC migration teams can use the standing record to track algorithm replacements, deprecations and new introductions over time. - SCANOSS says full product details, including open source licence compliance and AI governance coverage, are available at earnie.dev.

The bottom line: - Earnie combines cryptographic inventory, reachability analysis and PQC readiness in a continuous scanning workflow that is meant to make migration planning more defensible and less manual.