QuantumReady
Answer the cryptography question with evidence, not prose
A bank, a government agency or a large enterprise sends you a security questionnaire with a section on cryptography. It asks which algorithms you use, where they are, and what your post-quantum roadmap is. Your engineering team does not know, because nobody has ever had to produce the list.
The questionnaire stops being a negotiation
A written answer invites a follow-up question. A bill of materials with file and line evidence invites a check, and a check is a much shorter conversation than a follow-up.
Per product, not per company
A CBOM for each product you ship, so the answer to "which product uses RSA-2048?" is a row in a table rather than a meeting.
Every claim has a line of code
Each finding carries the file, the line and the evidence behind it. The reviewer can check you, which is the point.
What you could not see is stated
Every report states its coverage limits. A plausible answer that falls apart under questioning is worse than an honest boundary.
A real report summary: the counts a customer questionnaire asks for, with the coverage statement attached.
Three steps, and the first one is free
1. Scan something public
Point the free scanner at a public repository or your public domain. You will see the report format, the risk classification and the evidence before you pay anything.
2. Scan the product you are being asked about
Link a private repository, or run the offline scanner inside your network. The report covers the source, the build artifact and the base image, which is where the OpenSSL nobody declared usually lives.
3. Attach the pack
Export the evidence pack and attach it to the questionnaire. If the customer wants a person to have reviewed it, that is a separate, fixed-price step.
What this does not do
It does not certify your product, and it does not make you compliant. It produces technical evidence with stated limits, and your attestation remains yours. If a customer asks for a certification, the honest answer is that this is the evidence a certifier would ask you for, not the certificate.