FAQ
Questions we get asked
Crypto agility, CBOMs, key custody and what a managed engagement actually involves.
What is crypto agility?
Crypto agility is the ability to change cryptographic algorithms across your infrastructure without rewriting and redeploying each system that uses them. It is what turns a vulnerability disclosure or a standards change from a multi-quarter program into a policy decision.
What is a CBOM?
A Cryptographic Bill of Materials is an inventory of the cryptographic assets, algorithms, keys and dependencies in use across your systems. 4Quays keeps it live from connected environments rather than as a spreadsheet that is stale the moment it is written.
Do we have to replace our existing systems?
No. 4Quays is a control plane over the systems you already run. Quantum-safe uplift happens inside the investments you keep, so there is no mandatory rip and replace.
Who holds the keys?
Keys are generated and managed by 4Quays, and the application never touches key material. Policy decides which algorithms and providers are permitted, and every operation is recorded in the cryptographic audit log.
Which post-quantum algorithms are supported?
The NIST post-quantum standards: ML-DSA for signatures at parameter sets 44, 65 and 87, and ML-KEM for key encapsulation at 512, 768 and 1024, alongside classical RSA and ECDSA for hybrid and legacy use.
How does this reach our SIEM and audit workflows?
Evidence flows into the tools you already use. 4Quays forwards operations, audit logs and alert events to Splunk, Microsoft Sentinel, Sumo Logic, Datadog, Elastic, IBM QRadar, CrowdStrike Falcon LogScale, or any generic webhook endpoint.
Can 4Quays secure our AI agents?
Yes. An enrolled agent gets its own ML-DSA signing key, and optionally an ML-KEM encryption key, held under policy. Agents sign, verify and encrypt through an MCP server or the TypeScript SDK, so messages are attributable and verifiable without the agent being redesigned.
What happens if a change misbehaves?
Adoption is staged and reversible. Hybrid modes let classical and post-quantum run together, changes are observable while they roll out, and rollback is controlled rather than improvised.
How do we get started?
Book a demo. We will walk the control plane against your environment, scope what discovery and remediation would look like, and agree a staged plan from there.