SCANOSS's Earnie brings continuous cryptographic inventory and post-quantum readiness to enterprise codebases

Inventory cryptographic algorithms and its dependencies, which ones are actually reached, and flags what won't survive the transition to post-quantum standards.

MADRID, MADRID, SPAIN, October 16, 2026 /EINPresswire.com/ -- SCANOSS today detailed the cryptography and post-quantum (PQC) readiness capabilities of Earnie, the major release of its code governance solution that publicly launched October 6, 2026 at a live online event.

Organisations preparing for the shift to quantum-safe cryptography face a problem that comes before migration itself: most don't have a reliable inventory of the cryptographic algorithms already running inside their software. Cryptographic elements are frequently buried several layers deep in dependencies, making them easy to miss without a consistent way to record what's found.

Earnie addresses this by scanning a codebase and its dependencies for cryptographic algorithms, protocols, certificates and key material, and producing a structured Cryptography Bill of Materials (CBOM), the same discipline an SBOM applies to software dependencies, narrowed to cryptography. Each finding carries a post-quantum status that flags quantum-vulnerable algorithms such as RSA or ECDH, along with a severity drawn from curated assessment tables Earnie publishes, so a migration effort can prioritise with evidence rather than guesswork.

Earnie goes a step beyond a static list of what's present in source. It also traces reachability: whether a cryptographic asset sits on a call path from an entry point of the application, shown hop by hop in a call trace. Where the analysis can't decide, the finding says so instead of guessing. That distinction lets teams work through reachable findings first, and it follows the same policy-and-evidence model Earnie applies across every domain: a finding connects to a decision, and the decision is recorded with its evidence.

Because Earnie runs continuously, scanning every commit and pull request, the cryptographic inventory doesn't go stale the moment migration begins. Each completed scan shows what changed since the last full one, with findings counted as new, resolved, re-detected or still open. As algorithms are replaced, deprecated or newly introduced, the record reflects the current state of the estate, giving PQC migration leads a standing record they don't have to refresh by hand.

The same inventory supports a second, adjacent need: export control. Cryptographic inventories are foundational evidence for export classification, and alongside each CBOM Earnie produces an export-control evidence report that gives trade-compliance teams the factual foundation for their own self-classification, without making a legal determination.

- A structured CBOM in CycloneDX, with reachability and export-control signals on every asset
- Reachability evidence, with a call trace for every reachable finding
- Severity and post-quantum status on every finding to prioritise PQC migration planning
- A standing, versioned record as the cryptographic estate changes

Earnie's cryptographic detection currently recognises more than 120 cryptographic algorithms. Detection runs inside the customer's own Earnie environment, whether SCANOSS hosts it or the customer runs it on-premises, and source code never leaves that environment. Findings are deterministic — the same code produces the same result every time — which is what makes the resulting record defensible to an auditor or regulator.

The cryptography and PQC readiness capabilities are available now as part of Earnie. Full details, including coverage of open source licence compliance and AI governance, are available at earnie.dev.

SCANOSS Communications
SCAN OPEN SOURCE SOLUTIONS SL
Visit us on social media:
LinkedIn
YouTube
Other

Meet Earnie: governance that keeps up with agent-written code