# How can we find where we use quantum-vulnerable cryptography?

Start with an inventory: certificates, VPNs, TLS on your servers, SSH, code signing and the libraries your applications use. Network traffic shows a large part of it, because the key exchange of each TLS connection is visible without decryption. NQCI, the NetSenX crypto inventory (in preview), is visible on every plan and active from the Pro plan: it shows which connections use quantum-vulnerable key exchange and which use hybrid post-quantum key exchange. It needs the packet-capture sensor, which is off by default: switched on for a Linux agent, or a sensor on a SPAN or TAP port. The agent's basic mode, used on macOS, does not see TLS handshakes. It gives visibility; the migration itself stays with you and your vendors.

FAQ: [Post-quantum cryptography](https://netsenx.com/en/faq/pqc) · https://netsenx.com/en/faq/how-to-find-quantum-vulnerable-cryptography

## Read next

- https://netsenx.com/en/encrypted-traffic-analysis
- https://netsenx.com/en/features
- https://netsenx.com/en/blog/2026-10-27_harvest-now-decrypt-later

## Related questions

- [Can a network sensor build a cryptographic inventory?](https://netsenx.com/en/faq/can-a-network-sensor-build-a-cryptographic-inventory)
- [How do I find which connections already use hybrid key exchange?](https://netsenx.com/en/faq/which-connections-already-use-hybrid-key-exchange)
- [What should a cryptographic inventory include?](https://netsenx.com/en/faq/what-should-a-cryptographic-inventory-include)
- [Does NetSenX protect us against quantum computers?](https://netsenx.com/en/faq/does-netsenx-protect-us-against-quantum-computers)
- [How do we answer an RFP question about post-quantum readiness?](https://netsenx.com/en/faq/how-to-answer-an-rfp-question-on-post-quantum-readiness)