Welcome
BigFix Quantum Risk Analyzer
The BigFix Quantum Risk Analyzer (QRA) is an add-on that discovers and assesses the cryptographic posture of your managed endpoints, so you can find quantum-vulnerable systems, prioritize remediation, and demonstrate compliance from the BigFix Console.
Reference Guide
Performance Optimization
The scanner includes intelligent CPU throttling controls to manage system resource usage during intensive cipher enumeration scans.

BigFix Documentation Homepage
BigFix AEX
Welcome to the BigFix AEX (Advanced Endpoint Management) documentation.
Runbook AI (Add-on)
The Runbook AI (Add-on) is designed for both BigFix Runbook AI administrators and end users who are working towards the resolution of IT support tickets. Its primary purpose is to help BigFix administrators to easily monitor the health of their servers and initiate well-informed recovery actions with specialized Runbooks AI.
CISA Known Exploited Vulnerabilities (KEV): Overview
The Known Exploited Vulnerabilities (KEV) Content Pack is available as an add-on for BigFix. It is a collection of BigFix Fixlets that is derived from extensive research of the CISA KEV catalog, NVD, and Vendor Advisories. This KEV Content Pack provides BigFix operators with the ability to quickly identify endpoints with vulnerabilities that are high-risk and time-sensitive given that they are known to have been exploited or are actively being exploited.
Payment Card Industry (PCI) Add-on User Guide
The BigFix PCI DSS Add-On is a premium component that provides security configuration checklists that are based the Payment Card Industry Data Security Standard (PCI DSS). These compliance checks are designed to help ensure continuous compliance at every endpoint in your organization.
RHEL ESU Add-On User's Guide
BigFix content supporting Red Hat's Extended Update Support (EUS) and Extended LifeCycle Support (ELS) patching program is available as an add-on to the BigFix Patch, BigFix Lifecycle, and BigFix Compliance products.
Service Graph Connector Integration
The Service Graph Connector is available as an add-on for integrating BigFix Inventory with your CMDB. The connector is designed to support common use cases and requires additional customizations to meet your specific business process requirements. Successful implementation of the connector requires thorough assessment and due diligence, and could involve modifications to input fields or the implementation of specialized reconciliation processes to align with your internal workflows.
Windows ESU Patch Add-On User's Guide
BigFix content supporting the Extended Support Updates (ESU) patching program from Microsoft® is available as an add-on to BigFix Patch, BigFix Lifecycle and BigFix Compliance.
BigFix Quantum Risk Analyzer
The BigFix Quantum Risk Analyzer (QRA) is an add-on that discovers and assesses the cryptographic posture of your managed endpoints, so you can find quantum-vulnerable systems, prioritize remediation, and demonstrate compliance from the BigFix Console.
- Administrator Guide
- Reference Guide
  - What is the scanner?
    The BigFix Quantum Risk Analyzer scanner is a cross-platform executable that you download and run on your endpoints to scan for cryptographic assets.
  - Quick Start
    This guide reviews multiple options for configuring your scans, optimizing your performance, and viewing your data. However, for those users who want to quickly begin scanning, below are the most common scan configurations with the simplest output options.
  - Installation
    Below are the basic steps for getting started. For more advanced installation steps or integrations, contact your HCL account representative.
  - Command Reference
    When you are ready to begin scanning, you can configure your scan with various commands to customize the scope, output, features, and more. The following section provides reference tables with the available commands.
  - Usage Examples
    This section provides examples for common scans combining the available command options. All commands below assume a valid license key is configured.
  - Hardware PQC Benchmark
    The Hardware PQC Benchmark runs real cryptographic operations on the host CPU during the scan to measure whether the CPU is fast enough to sustain PQC workloads at production throughput.
  - PQC Discovery Details
    The BigFix Quantum Risk Analyzer scanner provides comprehensive detection and analysis of post-quantum cryptographic implementations, preparing your infrastructure for the quantum-safe future.
  - Cipher Suite Discovery Details
    The scanner performs active testing to discover all supported cryptographic configurations on remote services.
  - Quantum Readiness Scoring
    Learn how the BigFix Quantum Risk Analyzer scanner evaluates your organization's readiness for the post-quantum cryptography transition through comprehensive scoring algorithms.
  - TLS Letter Grade System
    In addition to the system-level 0-100 score, each TLS port, application, and the overall system receives a letter grade (A+ through F) derived from what the scanner observes on the wire: TLS protocol, key exchange, certificate, and cipher suite quality.
  - Platform Support for Scans
    The BigFix Quantum Risk Analyzer scanner supports Windows, macOS, and Linux platforms for cryptographic asset discovery.
  - Performance Optimization
    The scanner includes intelligent CPU throttling controls to manage system resource usage during intensive cipher enumeration scans.
  - Advanced System Use
    Advanced examples for enterprise security assessment, incident response, continuous monitoring, and VDI identity. All commands below assume a valid license key is configured.
  - Filesystem Scanning Details
    The scanner provides comprehensive filesystem scanning capabilities to discover cryptographic assets across your systems.
  - VPN Client Support
    The scanner supports detection of 19 VPN clients across Windows, macOS, and Linux platforms. Each client is assessed for post-quantum cryptography (PQC) readiness and migration status.
  - Split Outputs and Detail Levels
    The scanner provides two features for controlling output organization and size: split outputs (separate files per dataset type) and detail levels (control output verbosity).
  - Frequently Asked Questions
    This FAQ section provides answers to common questions about the BigFix Quantum Risk Analyzer scanner, its compliance with federal mandates, and how it helps organizations prepare for the post-quantum cryptography era.
  - Appendix A: Output Formats
    The scanner supports multiple output formats to suit integration, compliance, and reporting use cases: JSON, CBOM, OMB CSV, Flat NDJSON, HTML, and EventLog.
  - Appendix B: Network Security
    The scanner implements context-aware network security measures. SSRF protection applies only to integration service configurations (Kafka, Elasticsearch, Splunk, S3) while allowing full network access for legitimate security scanning via -host flags.
  - Appendix C: Additional Security Considerations
    Additional considerations for scanning, data privacy, and antivirus configuration.
  - Appendix D: CPU Throttling Guidance
    The -cputhrottle flag provides comprehensive control over CPU usage across all resource-intensive operations. This feature prevents system overload, ensures smooth operation alongside other applications, and provides predictable performance characteristics.
BigFix Patch Workbench Add-On
This topic provides an overview of BigFix Patch Workbench, an automated solution that streamlines patch deployment, reduces tool fragmentation, integrates with ServiceNow, and enhances compliance and productivity across ITSM processes.
Add-ons guides in PDF format
Below is a comprehensive list of links to the Add-ons user guides available in PDF format, designed to assist users in navigating and utilizing the software effectively:

Performance Optimization

The scanner includes intelligent CPU throttling controls to manage system resource usage during intensive cipher enumeration scans.

CPU Throttling for Resource Management

Throttling Levels

none - Original behavior (up to 25 concurrent workers)
low - 50% of CPU cores, conservative resource usage
medium - 75% of CPU cores, balanced performance (default)
high - 100% of CPU cores, maximum performance

Adaptive Features

Dynamic concurrency adjustment based on system load
Performance monitoring and logging when enabled
Intelligent throttle delays to reduce CPU pressure
Automatic scaling based on available CPU cores

CPU Throttling Examples

# Conservative resource usage for production environments
./certscanner -host example.com -cipherscanquick -cputhrottle low

# Balanced performance (recommended default)
./certscanner -host example.com -cipherscanquick -cputhrottle medium

# Maximum performance with monitoring
./certscanner -host example.com -cipherscanquick -cputhrottle high -logfile performance.log

# Performance monitoring comparison
./certscanner -host example.com -cipherscanquick -cputhrottle none -logfile baseline.log

Performance Impact

Testing shows that -cputhrottle low reduces CPU usage from 100% to approximately 68% while maintaining scan effectiveness. This makes it ideal for production environments where system stability is prioritized over scan speed.