SQOUT 1.0

Today we released SQOUT v1.0.0. The number has a meaning for us: the core of SQOUT is complete. The tools that model, analyse and score a quantum system are fully implemented, and they work together. From now on, most of our work goes into the intelligence that those tools read.

SQOUT is about the security of quantum technology itself, not about post-quantum cryptography migration. It helps you understand how a QKD link, a quantum network or a quantum device can be attacked, and what your defences are really worth.

One model of your system, five tools

You describe your system once, as a QSystem. It holds the components, the connections, the protocols, the physics parameters and the countermeasures that you have in place. Five tools read the same QSystem. Nothing is typed twice, so the system that you analyse is always the system that you designed.

QBuilder: design the device

QBuilder is the drawing board for a single device, for example a QKD transmitter or receiver. You drag real parts from the catalogue onto a canvas, connect them, and attach the protocols and countermeasures that protect them. Your organisation's own components appear in the palette next to ours. The same design is also a YAML document, which you can edit, keep under version control and load back. QuDef also maintains a library of reference designs, called blueprints, which you can copy into your workspace with one click.

QNetwork: design the network

QNetwork places your device designs on a canvas, and you connect them port to port. SQOUT then finds the quantum paths that the network can carry, recognises the QKD links and builds end-to-end routes through trusted relays. It shows which nodes hold your key in the clear, and it warns about a quantum link where the two ends share no authentication method. A detailed world map ships inside the product, so you can place nodes at their real locations without any request to an outside map server.

QAnalyser: find what applies

QAnalyser checks a device or a network against the whole catalogue. The report lists the attack techniques and weaknesses that touch your system. Each finding has a verdict, a risk rating from 0 to 100, a confidence level and the countermeasures that apply. Your experts can confirm any finding or change its verdict with a written reason, and the engine's original verdict stays visible next to theirs. You can compare two reports side by side. On subscriptions that include it, you can also schedule a re-run every two days, weekly, every two weeks or monthly, and an email tells you what changed.

QKill: put a number on the risk

QKill builds an attack as a chain of steps in four phases: Knowing, Entering, Finding and Exploiting. It scores the chain twice: once as if nothing defends the system, and once with the controls that you really have. The difference shows what your existing security is worth. You can mark a control as planned and see how the risk would change if you funded it. One of the risk methods is the attack-potential method of ISO/IEC 18045, which uses the same rating words as a Common Criteria evaluation lab.

QProof: what can the link claim? (still in development)

QProof implements published QKD security proofs as running code. You choose a proof, enter the physics of your own equipment and attach your measurements. QProof tells you how much secret key the proof allows, under which assumptions, and at which error rate the link must stop.

A tool that can say "no answer"

Many security tools show silence as green. When a scanner finds nothing, the dashboard says that everything is fine. But "nothing found" can also mean "nothing checked", and in quantum security this difference matters a lot.

SQOUT follows the opposite rule. When the evidence is missing, SQOUT refuses to give an answer, and it names what is missing. Some examples:

• QProof never says "certified". Its best verdict is CONDITIONAL, because evidence that a system declares about itself does not earn a certificate. A good key rate never upgrades a verdict.
• A partial match is a "potential threat". When your system holds only part of what an attack needs, QAnalyser does not report "not a threat". An incomplete report also says so in its own words: "the absence of a finding here does not mean the system is secure".
• An unknown node stops the analysis. If a route runs through a node whose inside nobody has described, the network report shows "Refused — no verdict can be given" and the reason. It does not pass the route.
• Missing physics is not zero. QNetwork does not compute a key rate for a link whose physics nobody has declared. We removed every default value, so a missing fibre length can never count as a link with no loss.
• An incomplete search says so. When the route search reaches its limit, the result says that coverage is incomplete. It does not present a partial list as the full list.

A tool that only says "no" would be useless. So SQOUT also shows you the way to an answer. For each path and each proof, QNetwork lists the physics parameters that are still missing. You add them, and you run the analysis again.

We think that a clear "no answer" is worth more than a confident wrong answer. An auditor, a regulator or your own customer can trust a result more when they know that the tool would have said so if it did not know.

The intelligence keeps growing

All five tools read one knowledge base about how quantum systems are attacked and defended. It uses tactics and techniques, which is the model that security teams know from MITRE ATT&CK. Each link between a technique and a countermeasure records how the control works, how effective it is, what risk is left over, and how confident the curator is. Techniques and countermeasures also link to MITRE ATT&CK, MITRE D3FEND, SPARTA, ESA Space Shield and NIST SP 800-53, so a quantum finding arrives in the language that your security team already uses.

This knowledge base is never finished, and it is where most of our work goes now. Our analysts, helped by automated tools, read new research and propose changes. A QuDef analyst approves every proposed change before it is published. An entry that nobody has reviewed for six months comes back for a new review.

New content reaches connected deployments in small steps, soon after we publish it. A disconnected installation receives the updates as an encrypted file that only that installation can open. In both cases, your next analysis run reads the current catalogue, so your next report already uses the latest intelligence.

Two recent additions show the direction:

• A catalogue of test methods, on the higher subscription tiers. The tests are linked to weaknesses, techniques and countermeasures, and a QAnalyser audit lists them so that you can record a result for each one.
• Post-Quantum Cryptography is a new domain. Its catalogue content is still being built.

You can contribute too. Your own hardware, techniques and weaknesses appear in your designs and in your QAnalyser reports. You can add your own papers to Literature, keep them private or share them with your organisation, and suggest them to QuDef.

What comes next

The 1.0 release itself is small: it fixes kill chain saves that added empty steps. The number recognises the work of the releases before it, which built the tools described above. We continue to improve every tool, and the knowledge base keeps changing.

If you need something that SQOUT does not do yet, tell us through the SQOUT helpdesk. Thank you for working with us on the way to 1.0.