SCANOSS's Earnie Maps Crypto In Code, Flags Quantum Risks

SCANOSS detailed new capabilities within Earnie, its code governance solution, to address a critical blind spot for organizations preparing for quantum computing. Most enterprises, according to SCANOSS Chief Product Officer Matias D’Aloia, “can’t see much of it,” referring to the cryptographic algorithms embedded within their codebases.

Earnie creates a structured Cryptography Bill of Materials (CBOM), mirroring the widely adopted Software Bill of Materials, and flags algorithms like RSA and ECDH as quantum-vulnerable, assigning a severity rating to prioritize remediation efforts. This continuous inventory, SCANOSS reports, traces cryptographic reachability and provides a standing record of an organization’s cryptographic estate.

Earnie Delivers Continuous Cryptographic Inventory with CBOM

Earnie, SCANOSS’s code governance solution, identifies over 120 cryptographic algorithms within a codebase and its dependencies, providing a level of detail previously unavailable to many organizations. This reachability analysis distinguishes Earnie from simple static lists, allowing teams to prioritize remediation efforts based on actual usage rather than potential presence. The CBOM produced by Earnie includes a severity rating for each identified algorithm, drawn from SCANOSS’s curated assessment tables, specifically flagging those vulnerable to quantum computing attacks.