Quantum-ready application security
See quantum-vulnerable cryptography in code and TLS without noise
47%
of HTTPS traffic is now post-quantum encrypted, up from 17% one year earlier [1]
Overview
Key benefits of quantum-ready application security
Cut application risk without slowing releases. OpenText Application Security gives your teams the coverage, accuracy, and flexibility to secure code, meet compliance, and keep the business moving.
-
Unify SAST + DAST visibility
See post-quantum cryptography risks in source code and TLS 1.3 configurations in one integrated view without stitching together separate tools.
-
Prioritize without panic
Start with early indicators, then tighten policy when your program is ready so teams stay focused on current priorities instead of future risks.
-
Track crypto use across dev teams
Detect RSA and DSA usage (starting with Java) and tie findings to code owners to simplify migration planning and assign clear remediation paths.
-
Spot missing PQC handshakes
Identify servers that don’t support hybrid post-quantum key exchange in TLS 1.3 (for example, X25519MLKEM768) and validate configuration updates with runtime scans.
-
Phase in detection on your terms
Control when and how post-quantum detection runs using SAST feature flags and informational DAST findings to balance planning with delivery speed.
-
Stay aligned with evolving standards
Plan confidently with a forward roadmap that evolves with NIST standards, key length best practices, and broader language coverage.
Business impacts
-
Quantum-risk visibility across code and runtime
Crypto risk hides when SAST findings and TLS settings are siloed across teams. OpenText connects both views so teams can inventory exposure and focus fixes during audits and planning.
-
Early phase detection without alert fatigue
Post-quantum alerts can overwhelm teams as risk timelines shift, especially near release freezes. Noise-aware controls help teams phase in detection and scale policies when ready.
-
Migration backlog built from real code
Teams often don’t know where quantum-vulnerable algorithms live in legacy code or libraries. OpenText automates discovery, builds a real backlog, and maps findings to owners.
-
TLS upgrades with proof, not guesswork
TLS risks can stay hidden across complex environments, delaying readiness. OpenText Dynamic Application Security Testing (DAST) flags missing hybrid PQC handshakes so teams can prioritize and validate upgrades.
Explore the components of the solution
Related products
Solve business challenges with OpenText
- OpenText™ Static Application Security Testing Find quantum-vulnerable crypto in code; enable PQC rules when you’re ready
- OpenText™ Dynamic Application Security Testing Identify missing PQC-resilient TLS 1.3 hybrid key exchange
- OpenText™ Core Application Security Scale AppSec-as-a-service for teams that need speed and coverage
Professional services
OpenText Consulting Services combines end-to-end solution implementation with comprehensive technology services to help improve systems
- Accelerate your Information Management journeyConsulting services
- Comprehensive Information Management services and resourcesExplore professional services
- Reduce time-to-value of Information Management solutionsPackaged Services
Customer stories
Scaled AppSec across teams to find and fix risk earlier in the pipeline
Learn more
Improved security and compliance with integrated testing across the SDLC
Learn more
Secured high assurance apps in constrained environments with repeatable testing
Learn moreReduced manual testing and improved coverage with automated AppSec scans
Learn more-
Quantum Ready Application Security combines Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) to identify cryptographic algorithms that are secure against classical attacks but will be vulnerable to future quantum computers. SAST scans your code for vulnerable crypto patterns while DAST checks TLS 1.3 configurations for missing hybrid post quantum key exchanges like X25519MLKEM768.
-
OpenText SAST uses optional post quantum detection rules to flag algorithms that rely on hardness assumptions broken by quantum computers. When the PQC feature flag is enabled, SAST identifies instances of RSA or DSA usage in your code. Results show exactly where these algorithms appear so you can build a cryptographic inventory and plan migrations.
-
The first release of post quantum rules focuses on RSA and DSA. SAST flags code that generates or uses RSA or DSA keys—algorithms known to be vulnerable to Shor’s quantum factoring algorithm. OpenText’s roadmap extends coverage to other legacy algorithms and key exchange protocols as standards evolve.
-
Yes. Post quantum detection is disabled by default to reduce noise for organizations not yet planning migrations. To enable it, set the [com.fortify.sca.rules.enablePQCRules] feature flag. When disabled, SAST reports only traditional crypto vulnerabilities; when enabled, it adds RSA and DSA findings for inventory purposes.
-
OpenText DAST introduces a new category called “Insecure Transport: Missing PQC Resilient Key Exchange.” It checks whether a web server’s TLS 1.3 configuration supports hybrid post quantum key exchange options, such as X25519MLKEM768. If none are offered, DAST generates an informational finding, so teams know which endpoints need configuration updates.
-
To balance security and practicality, OpenText makes post quantum detection opt in and low severity. SAST’s quantum related rules are behind a feature flag so you decide when to start generating findings. DAST reports missing hybrid key exchanges as informational rather than high severity, ensuring teams can plan without blocking releases.
-
No. This solution helps you find and plan for cryptographic migrations; it does not implement new post quantum encryption. SAST and DAST surface where legacy algorithms are used and where TLS lacks hybrid PQC support, allowing you to prepare a migration strategy. It is about planning and prioritization, not an automatic replacement of encryption schemes.
-
OpenText plans to expand its post quantum capabilities beyond RSA and DSA. Future releases will detect additional quantum vulnerable algorithms and key exchange protocols, analyze key lengths (e.g., highlighting when AES 128 is inadequate in a post quantum context), and extend post quantum detection across more programming languages.
Preparing for post-quantum cryptography with OpenText SAST and DAST
Read the blog
Building trust in the age of emerging technologies—the new era of Appsec
Read the blogOpenText SAST 25.4 introduces optional PQC checks that flag RSA and DSA with enablePQCRules
View SAST post quantum checksContent update 25.4 adds DAST TLS 1.3 PQC check to inventory readiness and validate upgrades
Read content updateContent update 25.4 adds DAST TLS 1.3 PQC check to inventory readiness and validate upgrades
Read content updateHow can we help?
Footnotes
Footnotes
- [1] OpenText, Preparing for Post-Quantum Cryptography with OpenText SAST and DAST,October 2025