8e3a4708c833b913c1b5789437a4261f6afa0024a14659d9ff56e1fc3da8368aCBOM Report / by Scrutari AI
Know which cryptography protects your payment environment.
Run the free scanner in your own environment. It builds a PCI DSS 12.3.3 cryptographic inventory from code, configuration, certificates, and only the endpoints you list. Buy the signed CycloneDX 1.6 CBOM and QSA report when you are ready.
Scanner is free. The signed report is $990 once. Checkout uses a hosted Stripe Payment Link. Card data never touches Scrutari.
EVIDENCE FLOW01 / 03
01ScanObserved TLS
02Scope reviewCustomer attestation
SIGNED REPORT
ProtocolTLS 1.3Observed
Key storageHSM / KMSAttested
Review plan12 monthsAttested
SHA-256 / signature / source map
01Fixed scope
Know what is included and what remains unknown.
02Source labeled
Scan facts and your statements stay distinct.
03Offline check
Verify the delivered files without calling Scrutari.
FREE LOCAL TOOL
Run it yourself. See what is there.
Enter your email to download. No account, password, license token, or scanner telemetry. Code scanning stays offline. Endpoint checks make TLS handshakes only to the host:port entries you provide. The scanner does not send results to Scrutari.
fc375df23f9709c9c9400c2309002d919dfa69943872812f9388bc4f90ffc7f2macOS blocks browser-downloaded binaries on first run. Use the terminal install below, which avoids the block entirely, or clear the flag once: xattr -d com.apple.quarantine ./cbom-scan-v0.1.1-macos-arm64
The verifier is free and ungated: get scrutari-verify. The report public key is public too.
INSTALL FROM TERMINAL
Replace you@company.com with your email. The command uses the same email gate as the buttons and avoids the macOS quarantine prompt entirely. Check the SHA-256 shown above before running. Add --endpoints FILE only for hosts you choose to scan.
macOS / Apple Silicon
curl -fsS --data-urlencode 'email=you@company.com' --data-urlencode 'platform=macos' -o cbom-scan https://scrutari.ai/api/pci/download
chmod +x ./cbom-scan
./cbom-scan --code ./your-repo --output ./cbom-resultsLinux / x86_64
curl -fsS --data-urlencode 'email=you@company.com' --data-urlencode 'platform=linux' -o cbom-scan https://scrutari.ai/api/pci/download
chmod +x ./cbom-scan
./cbom-scan --code ./your-repo --output ./cbom-resultsHOW IT WORKS
Four steps, and you are prepared before you pay.
Scan for free
Run cbom-scan on your code and the endpoints you choose. It writes a CBOM and findings file on your machine.
Complete the questionnaire
Download the guided questionnaire and answer what scanning cannot see: key custody, storage encryption, internal systems. Most teams finish in under an hour.
Order the signed report
Review your findings and answers, then use Stripe's hosted checkout. Card data never touches Scrutari.
Reply with your files
Email the two output files and your answers. Receive the signed CBOM, readable report, and verification steps within one business day after complete inputs.
SAMPLE REPORT
A finding you can trace.
A sample payment API shows observed TLS facts beside customer-attested internal systems. The report states the scope, method, evidence source, and open items on its face.
A valid signature proves the delivered files have not changed since signing. It does not prove every system was disclosed or every attested answer is correct.
CBOM REPORT / SAMPLE2026-10-22
Fictional payment API
Public API TLSTLS 1.3, one negotiated suiteOBSERVED
API leaf certificateSubject, issuer, expiryOBSERVED
Database encryptionPurpose and locationATTESTED
Trusted PAN transit keysCustody and rotationATTESTED
WHAT YOU RECEIVE
One report. Clear evidence boundaries.
- Scope statement with included and excluded systems
- Observed protocols, cipher suites, key exchange, and certificate facts
- Customer-attested internal crypto uses and trusted key inventory
- 12.3.3 review, trend monitoring, and response plan references
- Control map, open items, source labels, and verification appendix
FAQ
The important boundaries, in plain words.
Does nothing leave your environment?
Your email is sent to Scrutari when you download. Code scanning is fully offline. If you list endpoints, the scanner makes TLS handshakes only to those hosts. It sends no results, telemetry, application data, or secrets to Scrutari. To order the report, you email selected results and questionnaire answers to us.
What do I submit to Scrutari?
You submit your email for the scanner download. For the signed report, you send the scan metadata and guided questionnaire answers needed for the agreed scope. That can include hostnames, protocol and certificate facts, system descriptions, key identifiers, and review references. Those details leave your environment. Do not send PAN, private keys, passwords, secret values, or raw traffic.
Will this make us PCI compliant?
No. This is an evidence package for two controls. Your QSA reviews your full PCI DSS assessment and decides what evidence is sufficient. Scrutari does not claim PCI certification.
Can it find every cipher suite in our environment?
It tests supported TLS suites on the endpoints you list and marks code or config references separately. Your team adds unscanned internal systems, other configurations in use, storage encryption, and exceptions. The report shows both sources.
What do we receive and when?
A signed CycloneDX 1.6 CBOM, a human-readable report, a scope and source map, and offline verification instructions. Delivery is within one business day after we receive complete inputs for the agreed scope.
Where do I pay?
The purchase button opens a hosted Stripe Payment Link. Card details never pass through Scrutari's site.
FIXED FEE
Give your QSA a report with a clear source for every claim.
The scanner is free. Pay once for the signed report package and a defined assessment scope. No subscription.
$990one-timeGet the $990 reportHosted Stripe checkout. Card data never touches Scrutari. If we cannot produce your report for any reason, we refund in full.