Spice Labs provides an automated service that creates a Post‑Quantum Cryptography (PQC) plan for Java‑based applications by scanning binaries in your Artifactory or Docker Hub registry. Their Surveyor tool generates a machine‑readable Cryptographic Bill of Materials (CBOM) and a color‑coded PQC security report—red, yellow, green—without requiring agents, source‑code access, or SBOMs, and integrates with CI/CD pipelines and GRC systems for ongoing compliance tracking.
Funding
$3M raised to dateRaised to date based on public sources. This may differ from the amount the company actually raised and is based only on what is publicly available on the internet.
BFounders
Product
Problem
Organizations using Java, Scala, and Kotlin lack an efficient way to inventory cryptographic components in their compiled artifacts, making it difficult to assess readiness for post‑quantum cryptography and to demonstrate compliance with standards such as CNSA 2.0, PCI DSS v4.0, and NIST IR 8547.
Solution
Spice Labs offers a scanner that analyzes binaries stored in Artifactory or Docker Hub registries without requiring source code access or agent installation. The tool generates a CycloneDX Cryptographic Bill of Materials (CBOM) that lists all signing keys, certificates, and key‑exchange mechanisms present in each artifact. A color‑coded PQC Security Report (red, yellow, green) highlights quantum‑vulnerable components and maps compliance against major standards. The CBOM and report can be fed into GRC platforms, migration tooling, or AI‑driven remediation agents. Optional Java Flight Recorder instrumentation can be added to CI/CD pipelines to verify that builds remain free of vulnerable crypto over time.
Target Audience
Primary customers are engineering and DevSecOps teams responsible for Java‑based application portfolios, as well as system integrators and PQC consultancy firms that need artifact‑level visibility for client assessments.
Features
- Registry‑level scanning of JAR, WAR, and container images to produce a machine‑readable CycloneDX CBOM
- No agents, no source‑code analysis, and no modification of existing build processes
- Color‑coded PQC Security Report that grades each component against CNSA 2.0, PCI DSS v4.0, and NIST IR 8547
- Integration hooks for GRC tools and migration platforms, enabling automated compliance tracking
- Java Flight Recorder instrumentation for CI/CD pipelines to detect runtime crypto usage, including dynamically loaded providers and reflection‑based selections
- Support for custom‑compiled cryptography identified by hash, ensuring legacy or proprietary components are included