Welcome
BigFix Quantum Risk Analyzer
The BigFix Quantum Risk Analyzer (QRA) is an add-on that discovers and assesses the cryptographic posture of your managed endpoints, so you can find quantum-vulnerable systems, prioritize remediation, and demonstrate compliance from the BigFix Console.
Reference Guide
PQC Discovery Details
The BigFix Quantum Risk Analyzer scanner provides comprehensive detection and analysis of post-quantum cryptographic implementations, preparing your infrastructure for the quantum-safe future.

BigFix Documentation Homepage
BigFix AEX
Welcome to the BigFix AEX (Advanced Endpoint Management) documentation.
Runbook AI (Add-on)
The Runbook AI (Add-on) is designed for both BigFix Runbook AI administrators and end users who are working towards the resolution of IT support tickets. Its primary purpose is to help BigFix administrators to easily monitor the health of their servers and initiate well-informed recovery actions with specialized Runbooks AI.
CISA Known Exploited Vulnerabilities (KEV): Overview
The Known Exploited Vulnerabilities (KEV) Content Pack is available as an add-on for BigFix. It is a collection of BigFix Fixlets that is derived from extensive research of the CISA KEV catalog, NVD, and Vendor Advisories. This KEV Content Pack provides BigFix operators with the ability to quickly identify endpoints with vulnerabilities that are high-risk and time-sensitive given that they are known to have been exploited or are actively being exploited.
Payment Card Industry (PCI) Add-on User Guide
The BigFix PCI DSS Add-On is a premium component that provides security configuration checklists that are based the Payment Card Industry Data Security Standard (PCI DSS). These compliance checks are designed to help ensure continuous compliance at every endpoint in your organization.
RHEL ESU Add-On User's Guide
BigFix content supporting Red Hat's Extended Update Support (EUS) and Extended LifeCycle Support (ELS) patching program is available as an add-on to the BigFix Patch, BigFix Lifecycle, and BigFix Compliance products.
Service Graph Connector Integration
The Service Graph Connector is available as an add-on for integrating BigFix Inventory with your CMDB. The connector is designed to support common use cases and requires additional customizations to meet your specific business process requirements. Successful implementation of the connector requires thorough assessment and due diligence, and could involve modifications to input fields or the implementation of specialized reconciliation processes to align with your internal workflows.
Windows ESU Patch Add-On User's Guide
BigFix content supporting the Extended Support Updates (ESU) patching program from Microsoft® is available as an add-on to BigFix Patch, BigFix Lifecycle and BigFix Compliance.
BigFix Quantum Risk Analyzer
The BigFix Quantum Risk Analyzer (QRA) is an add-on that discovers and assesses the cryptographic posture of your managed endpoints, so you can find quantum-vulnerable systems, prioritize remediation, and demonstrate compliance from the BigFix Console.
- Administrator Guide
- Reference Guide
  - What is the scanner?
    The BigFix Quantum Risk Analyzer scanner is a cross-platform executable that you download and run on your endpoints to scan for cryptographic assets.
  - Quick Start
    This guide reviews multiple options for configuring your scans, optimizing your performance, and viewing your data. However, for those users who want to quickly begin scanning, below are the most common scan configurations with the simplest output options.
  - Installation
    Below are the basic steps for getting started. For more advanced installation steps or integrations, contact your HCL account representative.
  - Command Reference
    When you are ready to begin scanning, you can configure your scan with various commands to customize the scope, output, features, and more. The following section provides reference tables with the available commands.
  - Usage Examples
    This section provides examples for common scans combining the available command options. All commands below assume a valid license key is configured.
  - Hardware PQC Benchmark
    The Hardware PQC Benchmark runs real cryptographic operations on the host CPU during the scan to measure whether the CPU is fast enough to sustain PQC workloads at production throughput.
  - PQC Discovery Details
    The BigFix Quantum Risk Analyzer scanner provides comprehensive detection and analysis of post-quantum cryptographic implementations, preparing your infrastructure for the quantum-safe future.
  - Cipher Suite Discovery Details
    The scanner performs active testing to discover all supported cryptographic configurations on remote services.
  - Quantum Readiness Scoring
    Learn how the BigFix Quantum Risk Analyzer scanner evaluates your organization's readiness for the post-quantum cryptography transition through comprehensive scoring algorithms.
  - TLS Letter Grade System
    In addition to the system-level 0-100 score, each TLS port, application, and the overall system receives a letter grade (A+ through F) derived from what the scanner observes on the wire: TLS protocol, key exchange, certificate, and cipher suite quality.
  - Platform Support for Scans
    The BigFix Quantum Risk Analyzer scanner supports Windows, macOS, and Linux platforms for cryptographic asset discovery.
  - Performance Optimization
    The scanner includes intelligent CPU throttling controls to manage system resource usage during intensive cipher enumeration scans.
  - Advanced System Use
    Advanced examples for enterprise security assessment, incident response, continuous monitoring, and VDI identity. All commands below assume a valid license key is configured.
  - Filesystem Scanning Details
    The scanner provides comprehensive filesystem scanning capabilities to discover cryptographic assets across your systems.
  - VPN Client Support
    The scanner supports detection of 19 VPN clients across Windows, macOS, and Linux platforms. Each client is assessed for post-quantum cryptography (PQC) readiness and migration status.
  - Split Outputs and Detail Levels
    The scanner provides two features for controlling output organization and size: split outputs (separate files per dataset type) and detail levels (control output verbosity).
  - Frequently Asked Questions
    This FAQ section provides answers to common questions about the BigFix Quantum Risk Analyzer scanner, its compliance with federal mandates, and how it helps organizations prepare for the post-quantum cryptography era.
  - Appendix A: Output Formats
    The scanner supports multiple output formats to suit integration, compliance, and reporting use cases: JSON, CBOM, OMB CSV, Flat NDJSON, HTML, and EventLog.
  - Appendix B: Network Security
    The scanner implements context-aware network security measures. SSRF protection applies only to integration service configurations (Kafka, Elasticsearch, Splunk, S3) while allowing full network access for legitimate security scanning via -host flags.
  - Appendix C: Additional Security Considerations
    Additional considerations for scanning, data privacy, and antivirus configuration.
  - Appendix D: CPU Throttling Guidance
    The -cputhrottle flag provides comprehensive control over CPU usage across all resource-intensive operations. This feature prevents system overload, ensures smooth operation alongside other applications, and provides predictable performance characteristics.
BigFix Patch Workbench Add-On
This topic provides an overview of BigFix Patch Workbench, an automated solution that streamlines patch deployment, reduces tool fragmentation, integrates with ServiceNow, and enhances compliance and productivity across ITSM processes.
Add-ons guides in PDF format
Below is a comprehensive list of links to the Add-ons user guides available in PDF format, designed to assist users in navigating and utilizing the software effectively:

PQC Discovery Details

The BigFix Quantum Risk Analyzer scanner provides comprehensive detection and analysis of post-quantum cryptographic implementations, preparing your infrastructure for the quantum-safe future.

Key Exchange Group Detection - 35+ PQC Groups Covered

The scanner uses a dual-mode detection strategy. For IANA-standardized groups it completes a full TLS 1.3 handshake as a PQC-capable client. For experimental and non-IANA groups (BIKE, FrodoKEM, draft-era hybrids) it identifies the server's required group via passive inspection of TLS HelloRetryRequest messages - ensuring no TLS server goes undetected regardless of its KEX requirements. Validated against all 721 ports of the Open Quantum Safe interop server.

Full Handshake (IANA Standard)

X25519MLKEM768
SecP256r1MLKEM768
SecP384r1MLKEM1024
MLKEM512 / MLKEM768 / MLKEM1024
All ECDHE, DHE, RSA groups

Passive HRR Detection

BIKE-L1 / L3 / L5 + classical hybrids
FrodoKEM-640/976/1344 (AES & SHAKE)
Draft ML-KEM hybrids (X25519/P-256/BP-256/P-384/BP-384/X448/BP-512/P-521)

Classical KEX (Full Handshake)

P-256, P-384, P-521
X25519, X448
ffdhe2048 - ffdhe8192
DHE, RSA key exchange

Digital Signature Algorithms

Falcon (NIST FIPS 206)

falcon512
falcon1024
falconpadded512
falconpadded1024

Dilithium (NIST FIPS 204)

dilithium2
dilithium3
dilithium5

MAYO (Multivariate)

mayo1
mayo2
mayo3
mayo5

SPHINCS+ (Hash-based)

sphincssha2*
sphincsshake*
128/192/256 variants
fsimple/ssimple modes

Complete Cipher Suite Intelligence Database

The BigFix Quantum Risk Analyzer online documentation provides a comprehensive, searchable database of 300+ cipher suites with detailed security analysis, quantum readiness assessments, and compliance information.