Security you can check.

IBM Quantum hardware jobs on record, each listed by ID

of our own claims corrected in public

findings reported to public infrastructure maintainers

published receipts recomputed by someone outside the studio. Be the first

We run the hardware we model

We run our own quantum circuits on IBM Quantum hardware instead of quoting someone else's threat model. 500 jobs are on record in our account, each listed with its ID. IBM job pages are visible only inside our account, so the list is a record we cannot edit, not a page you can open.

We correct ourselves in public

When one of our results does not hold, we say so on the site. 6 of our published claims are marked corrected, including results from March 2026 that turned out to have been computed on a simulator.

You can check our records without us

Our assessment tooling writes signed, linked records of its steps, and a free checker verifies them on your own machine, with no account and no network calls.

We measure systems people depend on

We look for failures in public infrastructure and report them where the maintainers work. 4 findings so far, each with a link you can open.

Our scanner is open source

PQC-Scout, which finds post-quantum exposure in a codebase, is published under the Apache 2.0 license. Read it before you trust it.

Touch your systems without written permission

Before an engagement we read only what is public. Anything that probes, scans or tests your systems starts after you authorise it in writing, and not before.

Sell offensive tooling

We build attack tooling to test our own defences. It is never a product and never leaves the studio.

Call a guess a finding

A result that has not been checked is labelled as such. When one of ours fails a check later, it is marked corrected on the claims registry, next to the original.

Give legal or investment advice

We produce evidence and assessments. Legal conclusions belong to your counsel, and nothing we publish is a recommendation to buy, sell or copy anything.