Resources / Financial Sector CBOM — Illustrative Scenario

TECHNICAL RESOURCE

How a Large Financial Institution Might Structure an Air-Gapped CBOM Discovery Run.

This is an illustrative scenario — a modelled walkthrough of how AQRA's capabilities would apply to a representative enterprise-scale banking environment. It is not based on a real client engagement.

Explore Walkthrough ↓
  • Modelled Walkthrough for Tier-1 Scheduled Commercial Banks
  • Mapped to RBI Q-SAFE & Master Directions 2026 Mandates
  • Zero Code or Data Exited the Simulated Bank Perimeter
1,200+
Modelled Repositories
2,281
Deduplicated Primitives
187
P1 Immediate-Action Items
0 KB
Outbound Network Telemetry
Important: This document is an illustrative scenario modelled on AQRA's capabilities and a representative banking environment. Figures such as '1,200+ repositories' and '2,481 primitives' are illustrative estimates, not results from a real client engagement. Qvanticalabs was incorporated in February 2026; real client case studies will replace this document as engagements complete.

CONTENTS

What This Document Covers

A representative scenario demonstrating how cryptographic discovery, CycloneDX CBOM generation, and risk prioritization operate in complex banking architecture.

01 SCENARIO CONTEXT

Scenario Context

Organisation: Large scheduled commercial bank with 200+ microservices, 15 core banking modules (including COBOL-based legacy), 8 payment switch integrations (UPI, SWIFT, IMPS), and 3 HSM clusters. Discovery scope: Source repositories, compiled CBS binaries, runtime payment switch configurations. Regulatory context: RBI Master Directions 2026, CERT-In CISG-2025-02, RBI Q-SAFE CBOM obligation.

02 PHASE 01 FINDINGS

Phase 01 findings — illustrative

Static code analysis of 1,200+ repositories surfaces 2,481 cryptographic primitive instances across 340 unique files. Binary parsing of CBS compiled artifacts finds 47 additional primitives not present in source repositories (third-party compiled modules). Runtime config audit of payment switches identifies 12 TLS cipher suite configurations, 6 of which include RC4 or 3DES (deprecated). Total unique primitives after deduplication: 2,281.

03 CBOM STRUCTURE

CBOM structure — illustrative

CycloneDX JSON output contains 2,281 entries categorized by quantum vulnerability priority:

  • P1 (migrate immediately): 187 entries — RSA-2048 in public-facing APIs, digital signature modules, and root CA operations.
  • P2 (plan migration within 12 months): 634 entries — RSA-2048 in internal API-to-API authentication.
  • P3 (long-term migration): 412 entries — ECDSA P-256 in internal certificate infrastructure.
  • P4 (monitor): 1,048 entries — AES-256-GCM, SHA-256, SHA-3.
04 REGULATORY DELIVERABLES

Regulatory output — illustrative

Phase 02 CBOM mapped to RBI Q-SAFE inventory requirement (complete cryptographic estate documented). Phase 03 migration roadmap mapped to DST NQM CII timeline (Phase 1 migration of P1 systems targeted for 2027). Board risk summary: 8.2% of total cryptographic primitives require immediate action; estimated migration cost range provided for budget planning.

RELATED TECHNICAL INTELLIGENCE

Explore Related Research & Specifications

PQC Migration Blueprint

Engineering roadmap for discovering and migrating legacy algorithms to NIST standards.

Read Blueprint →

CycloneDX CBOM Specification

Complete schema guide and taxonomy for CycloneDX 1.6 Cryptographic Bills of Materials.

Explore CBOM Guide →

Air-Gap Architecture Spec

Technical specification for zero-egress containerized deployment inside air-gapped enclaves.

Explore Spec →

NEXT STEP

Ready to apply this to your environment?

A scoping call maps the relevant standards and specifications to your specific infrastructure and regulatory obligations.

Back to All Resources →