SkyQon Digital Trust Center dashboard
Dashboard
Trust posture for …
GETTING STARTED · ~60 SECONDS
Your first scan in 60 seconds
-
✓
Account createdTenant
…is live on…. -
2
Add the first domain to monitorEnter the hostname you serve TLS on — e.g.
api.yourcompany.com— in the Monitored domains form below. Free plan covers up to 5 domains. -
3
Scan + first resultsWe auto-scan the moment you add a domain. Critical / warning / healthy verdicts land here within seconds. Email alerts arrive when a cert crosses a threshold.
Digital trust score
Not scored yet
Analyzing your trust posture…
30-day trend
▸
Posture distribution
–
monitored endpoints
–
monitored assets across domains, endpoints and mail
–certificates critical or expired right now
–certificates expiring within 30 days
–of the estate measured in the last scan
Expiry distribution
Trust Score trend
Source: daily Trust Score snapshots for this tenant · range set by the selector above
TLS certificate validity is shrinking
CA/Browser Forum ballot SC-081v3 steps the maximum public TLS
certificate lifetime down three times between 2026 and 2029. Renewal has to become
automation, not a calendar entry.
| Effective date | Maximum validity |
|---|---|
| before 2026-03-15 | 398 days |
| 2026-03-15 | 200 days |
| 2027-03-15 | 100 days |
| 2029-03-15 | 47 days |
Source: CA/Browser Forum ballot SC-081v3 (adopted 2025-04-11) ·
effective 2026-03-15 / 2027-03-15 / 2029-03-15
Regulatory notice
Evidence, not attestations
EU supervisory frameworks — NIS2, DORA, the CRA — increasingly expect operators to show monitoring evidence aligned to their obligations, on demand. SkyQon's signed reports are built for that request: what was measured, when, and what it showed.
Open evidence reportsRegulatory watch curated by SkyQon
CRA reporting duties begin
From this date, manufacturers of products with digital elements must
report actively exploited vulnerabilities and severe incidents to ENISA within 24 hours.
2026-09-11
NIS2 supervision is national law
Most member states have transposed NIS2. In-scope entities owe
registration, incident reporting and evidence of the Art. 21 risk-management measures.
since 2024-10-17
DORA applies to EU financial entities
Financial entities must manage ICT third-party risk — expect supplier
evidence requests about the services you provide them.
since 2025-01-17
eIDAS 2.0 wallets are coming
Member states must offer EU Digital Identity Wallets; qualified
certificates (QWAC/QSealC) gain new relying-party duties.
expected late 2026
Curated by SkyQon · updated 2026-08-27 · not legal advice
What SkyQon has caught for you
Cyber-insurance readiness
A signed one-pager mapping your trust posture to the controls insurers ask
about — hand it to your broker at renewal, or share a public link.
—
Ranked fix queue
Ordered by score impact
Loading…
Latest scan
Loading…
Top sending regions View map →
Ranked fix queue ordered by severity × quick-win · copy-paste fixes
Ask the remediation copilot
AI · grounded in your findings
The AI copilot sends your posture metadata — grades, hostnames and finding types, never keys or secrets — to our AI provider (Anthropic) to draft tailored fix guidance. This processing currently takes place outside the EU, so it falls outside SkyQon's default EU-only data handling. The deterministic fix playbooks below are unaffected and never leave our infrastructure.
Ask a tenant administrator to enable the AI copilot.
Not sure where to start? Ask what to fix first, or how to remediate a specific finding.
Loading…
Certificate auto-renew Manage →
Loading…
Issued vs deployed Review →
Loading…
ASSETS
Monitored domains
The external hostnames SkyQon continuously verifies for TLS, certificate transparency, DNS, and email-authentication posture.
▾ Monitored domains
Loading…
| Domain | Added | Actions |
|---|
Have a list?
Up to 5,000 domains; one per line or comma-separated.
SIGNALS
Alerts
Priority risk signals across certificates, certificate transparency, DNS, and email authentication, most severe first.
▾ Alerts
0 selected
Loading…
| Severity | Type | Title | Created | Actions |
|---|
SIGNALS
Action Center
Every open risk across certificates, email authentication, DNS, attack surface, domain registration, and alerts, ranked most-severe first, in a single queue.
Loading findings…
| Severity | Finding | Module |
|---|
INVENTORY
Certificates
Every TLS endpoint we can see, graded for expiry, trust chain and crypto, with post-quantum and eIDAS status alongside.
Lifetime Readiness — CA/Browser Forum SC-081 · 47-day horizon
—
Estate readiness
—/100
▾ Certificates
Loading…
| Host | Port | Subject CN | Issuer | Expires | Days left | Risk | PQ | Score |
|---|
DOMAIN TRUST
Email authentication
DMARC, SPF, DKIM, CAA, MTA-STS, TLS-RPT and BIMI — the records that decide whether someone can spoof mail from your domain. Each domain gets a plain letter grade and a short list of what to fix next.
▾ Email & DNS posture
DMARC, SPF, CAA, common DKIM selectors plus MTA-STS, TLS-RPT and
BIMI: the non-TLS half of your domain trust posture. Each domain
gets a letter grade A–F plus a list of actionable findings. Daily
scan; trigger anytime with Scan now. Click a row
for raw records + DKIM key details + MTA-STS policy.
Loading…
A 90–100 · Strong
B 75–89 · Good
C 60–74 · Fair
D 40–59 · Weak
F <40 · Critical: fix now
Each domain scores 0–100 from its DMARC/SPF/DKIM/CAA + MTA-STS/TLS-RPT/BIMI records; the letter is the band. Click a row for the per-check breakdown.
| Domain | Grade | Score | SPF | DMARC | CAA | DKIM | Top finding |
|---|
DOMAIN TRUST · DMARC ENFORCEMENT
DMARC
Authorized senders, volume distribution, and aggregate-report intelligence, the evidence behind safe DMARC enforcement.
Volume distribution by DMARC compliance
Loading…
Compliant
Non-compliant
Top sending sources by volume
| Sending Source | Volume |
|---|
Sending sources
Loading…
| Source IP | Vendor | From domain | Volume | Pass rate | Fail | First seen | Last seen | Actions |
|---|
Aggregate reports
Loading…
| Reporter | Domain | Period | Messages | Pass | Fail | Received |
|---|
Geographic distribution
🗺️
GeoMap: Business tier feature
See exactly which countries your email originates from, with pass/fail breakdown per region.
Upgrade to Business to unlock geographic source analysis.
Pass rate:
≥ 95%
60–94%
30–59%
< 30%
Circle size = relative message volume
| Country | Volume | Pass rate | Pass | Fail |
|---|
Blacklist / RBL check
🚫
Blacklist Monitor: Growth tier feature
Checks your DMARC aggregate report source IPs against Spamhaus ZEN, SORBS,
and Barracuda. Blacklisted IPs cause immediate delivery failures at major mailbox providers.
Upgrade to Growth to enable.
—
Listed IPs
—
DNSBL hits
Last checked
—
✓
No blacklisted IPs found, all DMARC source IPs are clean.
| IP address | DNSBL | Reason | First seen | Last checked |
|---|
Checks IPs from DMARC aggregate reports (last 30 days) against
Spamhaus ZEN, SORBS, and Barracuda.
Run automatically once per day.
▾ Publish DMARC record per domain
For each monitored domain, create or edit the DNS TXT record shown below.
Receivers (Gmail, Microsoft 365, Yahoo, …) will start sending aggregate
reports within 24 hours.
Loading…
Loading…
DOMAIN TRUST · DMARC ENFORCEMENT
DMARC Failure Reports
Per-message forensic failure reports (ruf=): exactly which messages failed DMARC authentication, and why.
Failure report summary
Loading…
Reports
Loading…
| Received | Domain | Source IP | From | Subject | Result | DKIM failure |
|---|
No failure reports in this window. If you've configured ruf= and reports are still absent, check the Setup tab for the correct address.
DOMAIN TRUST · SMTP TLS REPORTING
SMTP TLS Reports
RFC 8460 TLS-RPT: receiving mail servers report when TLS delivery to your domain succeeds or fails. Catch expired certs, downgrade attacks and STARTTLS breakage before mail stops flowing.
Loading…
SMTP TLS Reporting Pro
Your reports are being collected. Upgrade to Pro to investigate every failed TLS session — which receiving server, which sending IP, and why (expired cert, no STARTTLS, downgrade). Paired with DMARC as the Email Authentication & TLS Reporting pack.
Upgrade to investigate →TLS session summary
Received reports
| Received | Reporter | Window | Successful | Failed |
|---|
No TLS reports in this window yet. Publish the
_smtp._tls record above; reports arrive within a day or two of mail flow.
No reports match this search or filter in the chosen window.
DOMAIN TRUST · BROWSER SECURITY REPORTS
Browser Security Reports
Collect Content-Security-Policy violations and Network Error Logging (NEL) reports straight from your visitors' browsers — see blocked scripts, mixed content, and TLS/connection failures your server-side scans can't observe.
Set up collection
Loading…
Collected reports Pro
Once you publish the headers above, your visitors' browsers start sending CSP and NEL reports here. Upgrade to Pro to view the collected violations — which directive, which blocked resource, on which page, and how often. Sits with Subdomain Risk in the web-layer attack-surface pack.
Upgrade to view reports →Report summary
Top violations
| Type | Directive / reason | Blocked host | Pages | Hits | Last seen |
|---|
No browser reports collected yet. Publish the headers above; reports arrive as visitors hit pages that trigger a violation.
No violations match this search in the chosen window.
DOMAIN TRUST
DNS security
DNSSEC, nameserver resilience and mail routing — the DNS layer everything else depends on. Each domain gets a letter grade and the specific checks behind it.
▾ DNSSEC, NS & MX
DNSSEC chain (DS + DNSKEY + AD-flag), nameserver SOA-serial
consistency and reachability, and MX target STARTTLS readiness.
Each domain gets a letter grade A–F plus actionable findings.
Daily scan; trigger anytime with Scan now.
Loading…
A 90–100 · Strong
B 75–89 · Good
C 60–74 · Fair
D 40–59 · Weak
F <40 · Critical: fix now
Each domain scores 0–100 from DNSSEC + nameserver + MX/STARTTLS checks; the letter is the band. Click a row for the per-check breakdown.
| Domain | Grade | Score | DNSSEC | Nameservers | MX / STARTTLS | Top finding |
|---|
DOMAIN TRUST
Domain registration
Registrar, expiry, transfer-lock and DNSSEC-delegation controls, the registry-side risks that can take a domain out from under you.
▾ WHOIS / RDAP registration
Each monitored domain is queried via RDAP (modern, JSON, ICANN-mandated)
or a hard-coded WHOIS server for the few European ccTLDs without RDAP.
Weekly scan; trigger anytime with Scan now.
Domains within 30 days of expiry raise a warning; within 7 days, critical.
Loading…
| Domain | Registrar | Expires | Days left | Transfer lock | DNSSEC | Source |
|---|
EXPOSURE
Attack surface
Forgotten subdomains and unauthorized certificates surfaced from Certificate Transparency and probed live, reclaim what's yours, dismiss what isn't.
Attack-surface discovery
Upgrade to Growth or Business to see the full attack-surface inventory, trigger on-demand scans, and receive alerts when new shadow hostnames appear in your zones.
- CT-log subdomain enumeration across your monitored zones
- Live DNS + TLS handshake on every discovered hostname
- Unauthorised-CA detection on shadow certs
- Slack / Teams / PagerDuty alerts on first observation
▾ Discovered hostnames
Hostnames in your monitored zones are discovered from Certificate
Transparency logs, certificate SANs, and your own SPF/MX/NS records,
then probed live (DNS + TLS handshake). Weekly sweep; trigger anytime
with Scan now. A first scan on a long history can take
~30s, the cap is 250 hosts per sweep, with the remainder processed on
the next tick.
Deep discovery
Finds hosts that never appear in any public record — no certificate,
no DNS reference — by testing common subdomain names and reading your
DNSSEC zone chain. Because that means hundreds of live DNS queries
against a zone, we ask you to prove you own it first.
Loading…
| Domain | Ownership | Deep discovery | Actions |
|---|
Loading…
| Hostname | Status | First seen | Found via | Resolves to | Issuer | Expires | Actions |
|---|
PROTECT
Brand protection
We watch the public certificate logs for domains impersonating yours, and verify the provenance of your published content. Anything suspicious lands here with the evidence attached.
▾ Certificate Transparency
Loading…
0 selected
| Severity | Finding | Domain / cert CN | Issuer | Detected | Actions |
|---|
CT log coverage
| Log | Status | Behind by | Last cycle |
|---|
▾ Authorised CA review
Loading…
Awaiting confirmation — seen issuing for your domains but not on your live servers.
Confirm the ones you recognise; investigate any you don't.
Trusted — accepted automatically (seen on your live servers, or confirmed).
▾ Lookalike Domains Add-on
SkyQon generates the typosquat variants of your domains an attacker would
register (homoglyph, omission, transposition, TLD-swap, …) and checks each
for liveness — does it resolve, send mail, or hold a TLS
certificate? A registrar or a TLS certificate alone is not evidence of
attack — every registered domain has a registrar, and certificates are
free; a certificate just means the domain is live and can
look convincing. Open a case when a close match is live and able to hurt
you — it resolves and can send mail or serves content impersonating you
(that is what CRITICAL risk and a threat score ≥ 70 approximate). Dormant
candidates: dismiss or just watch — the daily sweep re-checks and alerts
the moment one activates.
Loading…
| Risk | Threat | Candidate | Technique | Live signals | Registrar | Status | Actions |
|---|
▾ Takedown Center Add-on
Open a takedown case from any look-alike or unexpected-CA finding in the
Certificate Transparency table above (the Takedown action).
SkyQon resolves the offending domain's registrar + abuse contacts and
generates an evidence dossier you forward to the abuse desk, then tracks
the complaint through its lifecycle. SkyQon does not file complaints
on your behalf.
Loading…
| Severity | Offending domain | Impersonates | Registrar | Abuse contact | Status | Updated | Actions |
|---|
▾ C2PA content provenance
Signing certificates seen in ingested C2PA-signed assets. Trust combines
OCSP/CRL revocation with C2PA Trust List
CA membership. A signer whose certificate chains to a CA on the CAI
trust list and reports good revocation shows trusted;
an unlisted issuer, a revoked cert, or unknown revocation shows
not-trusted (conservative: never over-trust).
Loading…
| Signer | Issued by | Algorithm | Trust | Expires | Actions |
|---|
Recent asset checks
AI declaration shows what the asset's own manifest
states (for example an IPTC
trainedAlgorithmicMedia source
type). It is not an AI detector: a file without such a declaration may
still be AI-generated, because manifests are optional and can be stripped.
Loading…
| Checked | Signature | Signer trusted | AI declaration | Status |
|---|
Renewal readiness
Public TLS certificate lifetimes are being shortened on a fixed schedule
(CA/Browser Forum ballot SC-081v3): 200 days today,
100 days from 15 March 2027, 47 days from 15 March 2029.
Anything renewed by hand becomes eight renewals a year, per
certificate. This is what we can see of your estate today.
Loading…
0
No automation detected
0
Automated
0
Listeners seen
0
Renewals/yr from 2029
Microsoft AD CS certificates
Seal this verdict into your evidence chain: a signed PDF, hash-chained
with your other reports, that stays checkable months from now. Built for
a board paper, a supplier questionnaire, or the proposal that pays for
fixing it.
Loading…
▾ eIDAS qualification (EU)
Classifies each monitored TLS cert against the EU
List of Trusted Lists (eIDAS Regulation 910/2014).
A cert is QWAC when its chain anchors to a
Qualified Trust Service Provider whose CA service is
currently
granted and lists
ForWebSiteAuthentication. Other categories
(QSealC, QCertESig) cover
electronic seals and signatures rather than TLS.
Loading…
0
QWAC
0
QSealC
0
QCertESig
0
Qualified (generic)
0
Not qualified
0
Unassessed
▾ OV/EV identity verification
Cross-checks each monitored OV/EV cert against the authoritative
business registry in its jurisdiction:
Companies House (UK), KVK (NL), KBO (BE), to confirm the
organisation named in the cert actually exists, is still active,
and matches the registry's legal name. A mismatch typically
means an out-of-date cert, a dissolved company, or, in the
worst case: a fraudulent identity claim.
Loading…
0
Verified
0
Mismatch
0
Not found
0
Unsupported
0
Error
0
Unchecked
POST-QUANTUM
Quantum readiness
A clear view of where today's cryptography will need to change for the post-quantum era. See which certificates rely on quantum-vulnerable algorithms, understand what to migrate first, and plan the transition at your own pace. This is forward-looking guidance to help you prepare, not a vulnerability you need to fix today.
PQC Migration Suite
Upgrade to Growth or Business, or add the PQC Assistant to Pro, to see your post-quantum readiness score, per-asset quantum risk, harvest-now-decrypt-later exposure, and a NIST-aligned migration roadmap, with a guided Assistant for each fix.
- PQC readiness score across every monitored endpoint
- Per-asset quantum risk, Low / Medium / High / Critical
- Harvest-now-decrypt-later (HNDL) exposure detection
- NIST FIPS 203 / 204 / 205 migration roadmap (.docx)
Post-quantum readiness score
—
/100
Loading…
—
Crypto assets
—
Measured
—
Quantum-vulnerable
—
HNDL exposure
—
Hybrid key exchange
—
Critical risk
Advisory
Plan ahead for the post-quantum era
This score reflects the cryptography we observed on your scanned endpoints. NIST finalised the post-quantum standards (FIPS 203 / 204 / 205) in 2024, yet mainstream certificate authorities are not issuing post-quantum certificates in production today. Treat this as advisory guidance to help you prepare. The timelines are target windows, not deadlines, and there is nothing you need to fix today.
Source: NIST
Standards: FIPS 203 / 204 / 205
Recommended actions
Risk distribution
Loading…
PQC Assistant: start here
The guided way through the PQC Migration Suite. Work the steps in order;
open any endpoint's Plan button for its own step-by-step fix.
- Find: check what we found, and add what we cannot see from outside.
- Judge: see which endpoints are at risk and which data could be recorded now.
- Plan: follow the phased roadmap.
- Fix: open an endpoint's Plan, act on it or assign it to someone.
- Prove: generate the signed PQC posture report for your auditor or board.
Top recommended actions
The highest-impact next steps toward post-quantum readiness, most urgent
first. Working these moves your readiness score. Full per-asset detail is
under Crypto assets; the phased plan is under
Migration plan.
Loading…
Vulnerable certificates
Endpoints whose certificate cryptography is quantum-vulnerable
today (classical RSA / ECC). Prioritise these for a hybrid or post-quantum
migration as certificate-authority support matures.
Loading…
| Endpoint | Algorithm | Quantum status | Risk | HNDL | Renews | Recommended action |
|---|
HNDL exposure
Endpoints exposed to harvest-now-decrypt-later, traffic
an adversary could capture today and decrypt once a cryptographically
relevant quantum computer exists. Long-lived secrets make these the most
urgent to migrate.
Loading…
Needs review
Set business context (data sensitivity, secrecy lifetime, business
criticality) to triage each endpoint — it then moves into Reviewed
below, and you'll see whether the risk level held.
✓ Every harvest-now-decrypt-later endpoint has business context applied — see Reviewed below.
| Endpoint | Algorithm | Quantum status | Risk | HNDL | Renews | Recommended action |
|---|
| Endpoint | Algorithm | Quantum status | Risk change | HNDL | Renews | Recommended action |
|---|
Recommended actions
Every recommended next step across your monitored cryptography, most
urgent first. Each maps to an endpoint in Crypto assets.
Loading…
Tasks
Steps assigned from an endpoint's Assistant. A step shows as
confirmed once a scan sees the endpoint improve, not only when
someone ticks it. To add one, open an endpoint's Plan and use
Assign this step.
Loading…
Migration roadmap
A phased, board-approvable plan, discovery, readiness, migration prep,
crypto agility, and continuous monitoring. Each phase's progress is derived
from your current cryptographic posture; the windows are target guidance,
not deadlines.
Loading…
Migration priority
Your endpoints, most-urgent first. Each row shows the algorithm in use today, its quantum-risk band, whether it is exposed to harvest-now-decrypt-later, and the recommended next step toward post-quantum readiness.
Loading…
| Endpoint | Algorithm | Quantum status | Risk | HNDL | Renews | Recommended action |
|---|
Posture evidence reports
Generate a tamper-evident, point-in-time record of your post-quantum
readiness: readiness score, risk distribution, migration roadmap, and a
framework mapping (NIS2 / DORA / ISO 27001). Evidence supporting a
crypto-agility program, not a certification.
Loading…
| As of | Readiness | Assets | Critical | Generated | Actions |
|---|
Vendor PQC readiness
Most of your post-quantum risk sits with your suppliers. Send each vendor
the standard questionnaire, score their answers, and roll the results up
into one supplier-risk view. Advisory: based on what the vendor reports.
Loading…
| Vendor | Status | Readiness | Risk | Actions |
|---|
Discovery beyond public TLS
SkyQon scans your public TLS directly. Crypto also lives in VPNs, identity
providers, cloud services, internal APIs, and software dependencies. Declare
those systems or import an SBOM, discovered assets join your readiness
score, risk priorities, and roadmap. No internal network scanning; based on
what you declare or your SBOM reports.
Loading…
| System | Type | Source | Cryptography | Quantum status | Actions |
|---|
Cloud & identity connectors
Connect a cloud or identity provider to discover certificates that don't
front public TLS. Connectors are read-only and metadata-only
, for AWS we assume a role you grant us and call DescribeCertificate, never
ExportCertificate. We never store your cloud keys; only a role reference.
Discovered assets join your readiness score, risk priorities, and roadmap.
Grant SkyQon read-only access
Loading…
| Provider | Reference | Status | Last sync | Result | Actions |
|---|
Internal agents
Run a lightweight agent inside your network to discover
internal-only TLS endpoints we can't reach from the outside. The agent
pushes metadata only, outbound only, SkyQon never
connects into your network and never sees keys or traffic. Enrollment
tokens are write-only and shown once. Discovered assets join your
readiness score, risk priorities, and roadmap like any other source.
Copy this enrollment token now, it is shown once and
cannot be retrieved again. Configure your agent with it.
Loading…
| Name | Token | Status | Country | Version | Last seen | Last result | Actions |
|---|
WORKSPACE
Partner console MSP add-on
Manage the client organisations you monitor as a managed-service provider — sub-accounts, capacity, and white-label branding.
Sub-account capacity
Loading…
Sub-accounts
Loading…
| Client | Tenant ID | Plan | Billing | Status | Created | View |
|---|
Sub-account
read-only
Loading…
Add a sub-account
Creates a fully isolated tenant under your partnership. It starts with no
users — you manage it from this console. The sub-account count is capped by
your
sub_accounts add-on quantity.
White-label branding
Branding for your client-facing surfaces. Applied to sub-account
dashboards and report covers in an upcoming release — saved now so it's
ready. Leave a field blank to fall back to the SkyQon default.
Logo (PNG, ≤1 MB):
Billing rollup
Consolidated view of the client sub-accounts that bill through you, with each
plan's monthly list-price basis (EUR). MSP & Agency is
sold at custom partner pricing — this is a starting point for your invoice, not
a charged amount.
Loading…
| Sub-account | Plan | Active domains | List €/mo | Billing |
|---|
Client trust portfolio
Every managed client's trust posture in one table, worst-first. The PDF
carries your logo (set it under White-label branding) — ready for a QBR
or a client review.
Loading…
| Client | Grade | Score | Critical | Warnings | Assets | Open alerts |
|---|
Alert digest (open, unacknowledged — last 7 days)
Loading…
EVIDENCE
DORA Trust Center DORA add-on
Publish a supplier-readiness page that tags your continuous technical evidence to the DORA articles it supports — with Register-of-Information exports, a generated Art. 30 addendum, and a signed evidence PDF. Technical evidence + supplier readiness — not a statement of DORA compliance or certification.
Publication
Loading…
The public page is reachable only while published — unpublishing returns it to
404 immediately, so nothing leaks before you're ready. Customers confirm the
evidence integrity hash by recomputing it from the published evidence JSON.
Register of Information
Supplier-furnished data points that pre-fill your financial customers' RoI rows
and the generated Art. 30 addendum. Fields tagged counsel
are legal / corporate values your counsel should confirm before you publish.
Evidence preview
Exactly what your published page and signed PDF will show, assembled live from
your monitoring. Each item is tagged to the DORA article it evidences, with an
honest coverage level (direct / supporting).
Loading…
Fourth-party & concentration risk
Shared upstream dependencies across your estate — Certificate Authority, DNS provider,
mail provider — as evidence for your customer's preliminary assessment of ICT concentration
risk under DORA Art. 29. A measurement, not a rating: whether a concentration is acceptable is the
customer's call. Hosting/ASN and CDN are not yet covered.
Loading…
Supplier Trust
Grade your own ICT third-party suppliers' external trust surface — TLS, DNS security
and email authentication — as evidence for your DORA Art. 28–30 third-party risk
register. All public signal, no consent needed. External trust-surface grading
tied to your RoI — not a security rating.
Loading…
Supplier register. The document you hand an auditor: every
supplier above with the trust surface we measured, hashed for integrity and
digitally signed. Evidence for the registry and review process under
DORA Art. 28(3) and NIS2 implementing regulation (EU) 2024/2690 §5.2 —
not a compliance attestation, and neither regulation mandates
continuous supplier scanning.
Documents & exports
Shareable links for your financial customers. They resolve only while the trust
center is published.
CERTIFICATE LIFECYCLE · MACHINE IDENTITY
Auto-Renew Active
Turn your #1 alert — certificate expiry — into a fix. An agent on your host runs ACME locally and renews on schedule. Your private key is generated on your host and never leaves it — SkyQon orchestrates the schedule and proves each renewal; it never holds key material.
Renewal agents
Install one lightweight agent per host that holds the certificates you want renewed.
It pulls renewal jobs OUTBOUND — SkyQon never connects into your network. The same
agent also runs PQC discovery if you use it. The token is shown once.
Loading…
Enrollment token — copy it now, it won't be shown again:
Configure the agent (see
agent/renew-agent.example.env): set
SKYQON_BASE_URL, SKYQON_AGENT_TOKEN to this value, and your
ACME client command, then run on a timer.
Install renewed certificates automatically on the server
Pick what serves the certificate. Run the command on that host,
in the folder you unpacked the agent into, with the token from above.
How it stays safe: the agent stays an unprivileged user and only
asks for an install. A small root service on the host does the install, and it reads
the recipe and file paths from
/etc/skyqon-renew/install.json, which only
root can change. SkyQon cannot choose what runs or where. Before installing, it checks
the certificate names the host and matches its key. If the server rejects the new
configuration, the old files are put back. Change paths with
--install-opt.Managed certificates
Enroll a certificate by its domains (SANs). When it nears expiry the assigned agent
renews it from the chosen ACME directory. Issuance via Let's Encrypt staging
is recommended while you validate the flow, then switch to production.
Loading…
Recent renewal jobs
Loading…
Revocations evidence
Every certificate SkyQon has revoked for you, with the reason and (for
replace-then-revoke) the replacement. This is a verifiable evidence trail —
the agent performs the ACME revocation on your host; SkyQon never holds the key.
Loading…
CERTIFICATE LIFECYCLE · MACHINE IDENTITY
Machine Identities Growth+
Every cryptographic identity we can see for you, in one place — TLS certs from external scans, CT-discovered shadow hosts, certs you auto-renew (including internal ones from SkyQon's own CA), and non-TLS crypto assets. Deduplicated across sources, sorted by soonest expiry.
Inventory
0 selected
Loading…
Agent identities
Which non-human identities acted through your SkyQon agents, under which
issuer, with what certificate lifetime. Every X.509-SVID an agent presents
is logged once; the identity is its SPIFFE ID. Evidence for AI Act
Art. 12 record-keeping and the DORA / NIS2 asset registers — not a
certification, and no regulation mandates it.
Loading…
Loading…
CERTIFICATE LIFECYCLE · PRIVATE CA
Issued certificates Growth+
What your private CAs actually issued — the ledger behind issued-vs-deployed reconciliation. Connectors push incrementally from inside your network (EJBCA, HashiCorp Vault); any other CA can be imported from a PEM export. Revocation is tracked from each connector's own feed, or by polling the issuing CA's published CRL (Revocations). Your CAs and their counts are under Authorities; what runs out soon is under Expiring.
Connectors
Issuance records
Loading…
Import certificates
Paste a PEM bundle exported from any CA — Microsoft AD CS (
certutil), step-ca, or an appliance's export button. Certificates are parsed here and land in the ledger under the import connector. Each certificate's published CRL distribution points are registered automatically so revocation keeps being tracked.CERTIFICATE LIFECYCLE · PRIVATE CA
Revocations Growth+
How revocation reaches the ledger: the published certificate revocation lists (CRLs) SkyQon polls for certificates without a live connector. Imported certificates register their distribution points here automatically. The revoked certificates themselves are listed under Issued certificates — pick the Revoked tile.
CRL revocation feeds
SkyQon polls these from our infrastructure, so only publicly reachable CRL endpoints work here — a CRL served only inside your network is invisible to us, and certificates from that CA rely on their connector's own revocation feed instead.
http:// is correct and expected for CRLs (RFC 5280: a CRL is a signed artifact; the transport adds nothing).Loading…
CERTIFICATE LIFECYCLE · PRIVATE CA
Reconciliation Growth+
What your CAs issued, checked against what your endpoints actually serve. This is where the two halves disagree: a revoked certificate still in traffic, a certificate issued but never deployed, or a server presenting something no known CA of yours issued.
Findings
Loading…
CERTIFICATE LIFECYCLE · PRIVATE CA
CA health Add-on
One line per CA you issue from: is its revocation list current, does its OCSP responder answer, can its certificates be checked for revocation at all, is it issuing certificates that Windows or Adobe Acrobat will reject, and how many are post-quantum. Built from your issued-certificate register and CRL feeds, so it covers every CA at once.
Your CAs
Loading…
Findings
Loading…
Signed register
The register of valid certificates, each CA's health and the open findings, sealed into your tamper-evident evidence chain as a signed PDF — evidence for DORA (Delegated Regulation 2024/1774, Art. 7(4)) and NIS2 Article 21(2)(h). It supports an audit; it is not a certification.
Loading…
EVIDENCE · INCIDENT REPORTING
Incident readiness Add-on
Keep the Article 14 clock and the record alive: register the products you place on the EU market, record the moment of awareness when something happens, and this page computes the 24-hour, 72-hour and final-report deadlines (CRA Art. 14, NIS2 Art. 23, DORA Art. 19), alerts you before they pass, pre-fills the ENISA platform fields from your register, and keeps what you filed and when. Drills and the security.txt state of every monitored domain are sealed into your signed evidence chain. SkyQon never submits a report for you.
Where you stand
Loading…
Incidents and deadlines
T0 is the moment of awareness, not confirmation. Record it in UTC with its source; every deadline runs from it. When you file on ENISA's platform or with your CSIRT, record the submission here with its reference so the clock for the next stage starts from the right moment.
Loading…
Product register
The early warning must name the product, the versions affected and the Member States in which it was made available (Art. 14(2)(a)). Keep this current and the filing is pre-filled; leave Member States empty and it is counted as a gap, never guessed.
Loading…
Tabletop drills
A drill is an exercise, never a filing. Record the scenario, who took part and what broke; it becomes the first piece of evidence that the procedure is rehearsed.
Loading…
security.txt on your domains
The published contact a researcher or a CSIRT reaches first (RFC 9116). Awareness starts the 24-hour clock, so the intake must be findable and unexpired. Checked daily on every monitored domain.
Loading…
Signed readiness report
The register, every event with its deadlines and what was recorded as filed, the drills and the security.txt state, sealed into your tamper-evident evidence chain as a signed PDF. Evidence a market surveillance authority can be shown (CRA Art. 53); it is not a certification and it records your own entries, not any submission SkyQon observed.
Loading…
CERTIFICATE LIFECYCLE · PRIVATE CA
CA connectors Enterprise · add-on
Issue and revoke on your own private CA without leaving this dashboard — EJBCA or AWS Private CA. Issuing is from a certificate signing request only, so the private key of a certificate you issue here never reaches SkyQon. For EJBCA, SkyQon calls its REST API over mutual TLS with a client certificate that your CA issued, and the REST listener must be publicly reachable. For AWS Private CA, SkyQon uses an IAM role you create for it; no AWS key is stored.
Connectors
Loading…
Install the client certificate
Sign this request on your EJBCA with a certificate profile that allows Client Authentication, bind the resulting certificate to a role with the access rules below, then paste the certificate here. The matching private key was generated by SkyQon and is stored encrypted; it is never shown.
Access rules the role needs
Always:
/administrator/, /protocol/rest/, /ca/<your CA>/, /ca_functionality/view_ca/To issue:
/ca_functionality/use_ca/, /ra_functionality/create_end_entity/, /ra_functionality/edit_end_entity/, and create + edit on each end entity profile you issue fromTo revoke:
/ra_functionality/revoke_end_entity/, and revoke on each end entity profileTo publish a CRL after a revoke (optional):
/ca_functionality/create_crl/Also switch on System Configuration → Protocol Configuration → REST Certificate Management and REST CA Management.
Through your agent — AD CS, Vault PKI, internal EJBCA
For a CA SkyQon cannot reach directly, the agent inside your network can issue and revoke on your instruction. Every instruction is signed with your passkey, and the agent checks that signature against approver keys your team placed on the agent's host — SkyQon never holds them, so SkyQon itself cannot order anything. The host also decides which CAs, templates and how many per hour. It is off until switched on there; see the agent's README.
Your approver key
Loading…
CAs your agents may act on
Loading…
Issue a certificate
Make the key and the request on the machine that will use the certificate, for example
openssl req -new -newkey ec -pkeyopt ec_paramgen_curve:P-256 -nodes -keyout server.key -subj "/CN=app.example.com" -out server.csr, and paste the request. The key stays with you.You will be asked for your passkey. The agent then has five minutes to pick the instruction up; this page follows it until the CA answers.
Revoke a certificate
Revoking cannot be undone, except for a certificate placed on hold (EJBCA only — AWS Private CA has no hold). Pick a certificate from the list below, or enter the serial number and, for EJBCA, the issuer exactly as your CA shows them.
Through the agent: you will be asked for your passkey, and the agent reads the certificate's status back from the CA after revoking.
AWS Private CA publishes the revocation in its next revocation list, about 30 minutes after you revoke. There is no way to publish it sooner.
Issued and revoked through this dashboard
Every attempt is kept, including the ones your CA refused. This list cannot be edited or cleared, and it stays if a connector is removed.
Loading…
Instructions sent to agents
Each one shows who signed it, whether the agent picked it up, and what the agent's host decided. A refusal names the host setting that caused it.
Loading…
WORKSPACE
Add-ons
Capabilities you can add on top of your plan, priced for your plan and prorated to your billing period.
Your add-ons
Add capabilities on top of your plan. Buy them here: they
switch on straight away and billing is prorated to your current period.
WORKSPACE · DEVELOPER TOOL
Agent sandbox Test only All plans
Short-lived test certificates (X.509-SVIDs) for an AI agent you are building, so you can try mutual TLS between agents. They come from a separate sandbox test root — not SkyQon's production PKI. No SLA, no revocation, certificates expire in minutes. Not for production.
Loading…
Your private key never reaches SkyQon. Either this tab makes the key
and the certificate signing request for you and keeps the key in your
browser, or you make the CSR yourself and paste it.
Only copy — not stored
Using the API
Needs an API key with the write scope — make one in
Settings → Login & security → API keys. API access starts at the
Starter plan; on Free, use the form above.
| Code | Meaning |
|---|---|
| 201 | Issued. The body carries svid_pem, spiffe_id and not_after. |
| 400 | The agent name, the CSR or the lifetime was not accepted. Lifetime is 60–3600 seconds. |
| 403 | SkyQon has blocked sandbox access for this account. |
| 429 | Your plan's quota is used up. Retry-After says how long to wait. |
| 503 | The sandbox is switched off, or its CA is not configured. |
Only the public key inside the CSR is used — the subject and any
requested extensions are ignored. The name you choose lands in
…; the account part is
fixed server-side, so no account can claim another's namespace.
EVIDENCE
Reports
Auditor-ready NIS2 Art. 21 evidence and a per-tenant post-quantum migration roadmap, on demand.
Executive quarterly report
A board-facing quarterly summary: overall trust score with
quarter-over-quarter delta, certificate posture, and open risks —
rendered as a cryptographically signed PDF your leadership (or your
customer's security team) can verify independently.
Loading…
| Quarter | Score | Certificates | Critical | Generated | Actions |
|---|
Compliance evidence: NIS2
Generate an auditor-ready Certificate Evidence & Renewal-Control
Report for a period. Evidence supporting NIS2 Art. 21 measures,
not a certification. Every export is cryptographically verifiable —
you or your auditor can check any bundle at
/verify.
Your existing reports stay available to read, download and verify — evidence
you generated is yours to keep. Generating new reports needs the
Business plan or the NIS2 Evidence Pack add-on.
Reports auto-archive at 12 months.
Loading…
| Period | Type | Score | Endpoints | Generated | Status | Actions |
|---|
Post-Quantum migration roadmap
A board-ready, branded report with your readiness score and a prioritised
NIST FIPS 203 / 204 / 205 migration plan for your
current certificate inventory. Regenerated on every download.
Integrations
Browse all
Connect SkyQon to the tools your team already runs. Every
connection is explicit, uses write-only credentials, and can be removed at any time
on any plan.
Agent software
The agents run inside your network and connect
outbound only — SkyQon never opens a connection to you.
These are the full source bundles, not binaries: read the
script, check the digest below, then build and run it yourself. Each one
needs an enrollment token from its own section before it will do anything.
Loading…
Integrations
Connected
Manage what's already wired up — push posture into your GRC platform,
file findings as tickets, apply safe DNS fixes, and route alerts. Looking for
something new? Browse all integrations.
Nothing connected yet
No GRC platform, ticketing system, DNS provider, alert
channel, webhook, agent or SSO connection is configured for this tenant.
Alerts still reach your tenant contact email. Pick your first integration
from the catalog — most connect in a few minutes.
Browse all integrations →
GRC integrations Vanta · Drata
Feed SkyQon's continuous outside-in monitoring into your compliance
platform: every push syncs one posture record per monitored endpoint
(expiry runway, risk level, security score, PQ status), which your
Vanta custom tests or Drata custom connection turn into pass/fail
control evidence. Pushes run daily, or on demand.
Preview the exact records.
Loading…
Ticketing export Jira · ServiceNow
File SkyQon findings straight into the tool your team already works in.
Each ticket carries the finding, severity, affected asset and the exact
fix steps — so remediation happens in your queue, not a second dashboard.
Uses your tool's inbound-email address (Jira “Create issues from email”,
ServiceNow inbound email actions, or any mailbox); nothing to authorise.
File alerts by hand from the Alerts tab, or auto-file new ones at or above
a severity you choose.
Loading…
Recently filed tickets
DNS Auto-Apply Cloudflare · AWS Route 53
Turn remediation advice into action. Connect your DNS provider and SkyQon
will publish the exact record for a bounded set of fixes — a monitoring
DMARC record (
p=none), a rua= report
destination, a TLS-RPT record, plus (when the evidence supports it) a
one-step DMARC policy advance, a CAA record with the CA you pick, and the
MTA-STS pointer record. Every apply is an explicit click, shown as a
before/after diff, re-verified after writing — and undoable from the
change log below. SPF and DNSSEC stay as guidance in the Remediation
Center — never auto-applied.
Loading…
Applied changes
Alert email recipients
Every alert is emailed — it's the audit trail and is never plan-gated or
suppressed by delivery rules. Add up to 10 addresses (comma-separated);
leave the list empty to use your workspace contact email.
Chat & paging channels
Get alerts where your team already works. Paste an incoming-webhook URL
for Slack or Teams, or a PagerDuty routing key, and SkyQon will push
alerts there. Then hit Send test alert to confirm the
wiring end-to-end. Values are stored write-only — we show whether a
channel is connected, never the secret back.
Chat & paging is plan-gated: Slack & Teams need Pro,
PagerDuty needs Business. Channels your plan doesn't
include are shown but can't be connected.
Email alerting is unaffected — every alert is emailed on
every plan, including Free.
Outbound webhook
POST every alert to your own endpoint (SIEM, n8n, SOAR, ticketing).
Configure a signing secret and each delivery carries an
X-SkyQon-Signature HMAC your receiver can verify —
verification guide.
Signing: —
New signing secret (copy it now — it will never be shown again):
Delivery rules
Decide which severities reach each push channel, and silence pushes
during planned maintenance. Email alerts and the in-app alert list are
never suppressed — these rules gate paging, not detection.
Maintenance windows (UTC — weekly windows can be set via the API)
ACCOUNT
Profile & settings
Your identity, security, organization, billing and preferences — in one place.
Personal information
Loading…
Account actions
Sign out of this device, or end every session everywhere (useful if you’ve lost a device).
Preferences
Theme
Light, dark, or follow your system.
Sign out after inactivity
Automatically locks this device when idle. Stored per browser.
Scan frequency
How often SkyQon re-scans your domains.
—
Help & support
Technical questions — setup, scans, alerts, integrations, or anything not working as expected: [email protected]. We typically reply within one business day.
Workspace
Shortcuts to the surfaces below open in their own pages.
Team
Activity
Admin console
Team management and activity audit appear here for tenant admins.
Data retention
Choose how long inbound telemetry (CSP/NEL, DMARC and TLS-RPT reports) is
kept before automatic deletion. Your certificates and compliance evidence
are not affected. Minimum 30 days.
days
Partner management
Your account is managed by a partner. They can always view
your security posture. Turn this on to also let them act on
your behalf — run scans, acknowledge alerts, edit monitored domains, and
generate reports. You can revoke this at any time.
Running client accounts yourself? Your MSP console is under
Setup › Partner.
Login & security
Change password
Two-factor authentication (2FA): recommended
Protect your account with a time-based code from an authenticator app (Google Authenticator, 1Password, Authy…) in addition to your password.
Can't scan? Enter this secret manually:
✅ 2FA is on.
Recovery codes: save these now
Each works once if you lose your authenticator. They won't be shown again.
When on, each member must set up 2FA at their next sign-in before they can use the dashboard.
Active sessions & devices
Every sign-in is listed here. Revoke any you don’t recognise — the session stops working immediately, even if its token hasn’t expired.
Loading…
Passkeys
Sign in without a password using your device’s fingerprint, face, or PIN — or a hardware security key. Passkeys are phishing-resistant.
Loading…
Single sign-on (SSO)
Let your team sign in with your own identity provider (OIDC — Entra ID, Okta, Keycloak, Google Workspace…). Users are provisioned into this organisation automatically on first sign-in. SkyQon never sees their password — only your IdP does.
Configure your IdP with these Service Provider values:
Entity ID / Audience:
ACS (Reply) URL:
Metadata: SP metadata XML
Entity ID / Audience:
ACS (Reply) URL:
Metadata: SP metadata XML
Roles: tenant_admin, member, tenant_viewer. On each sign-in the
highest matched role is applied — promoting/demoting a user in your IdP propagates here.
Users in no mapped group get the default role above.
Enforcement unlocks after one successful SSO sign-in (so a mistake can’t lock you out). An admin can always turn it back off; SkyQon staff keep a break-glass path.
Break-glass accounts — may still use password login when SSO is enforced
Automated user provisioning (SCIM 2.0)
Connect your IdP's provisioning (Okta, Entra ID, OneLogin…) so users are created here automatically — and, crucially, deactivated the moment HR offboards them (their live sessions are killed instantly). Give your IdP the base URL below and a bearer token you generate here.
API keys
SkyQon exposes a REST API for programmatic access. Create a key to authenticate
requests with an X-API-Key: sky_live_… header. Read-only keys can’t
make changes; choose Read & write for automation that triggers scans
or generates reports. The full key is shown once at creation —
store it somewhere safe.
Browse the REST API reference →
every endpoint, with parameters, responses and a copy-paste
curl example.
Loading…
Your new API key — copy it now
This is the only time the full key is shown. It can’t be retrieved later.
Agent identity sandbox has moved to
Workspace → Agent sandbox in the sidebar, where it is
easier to find. Free test certificates for agents you are building.
Plan & billing
Loading your plan…
Secure checkout by Paddle, our Merchant of Record, card details never touch SkyQon. Your plan updates automatically once payment completes.
Self-serve checkout isn’t enabled yet. Tell us which plan you want and we’ll send an invoice to get you set up — usually the same business day.
Your requests
Add-ons
Your add-ons and everything you can add on top of your plan are on their
own page: Workspace → Add-ons.