Q by Wentzel · seed pitch · 2026
Adversaries are recording encrypted traffic today. Q finds the cryptographic estate, scores the harvest-now-decrypt-later exposure, and prices it in dollars a board can act on. Private beta — design partners in defense and finance.
The problem
The question every CISO in defense and finance gets from the board: “We know harvest-now-decrypt-later is real. What does it cost us, in dollars, and by when?” Today nobody can answer it.
01
Recorded TLS sessions decrypt retroactively the day a cryptographically relevant quantum computer (CRQC) arrives. Long-lived secrets — defense programs, financial records, health data — are breached-in-waiting.
02
Federal mandates now require cryptographic inventories, yet most organizations cannot list the ciphers, certificates, and key sizes across their own estate. No inventory means no migration plan.
03
Vulnerability tools emit severity colors. Boards allocate capital against dollar exposure and dates. Mosca’s inequality (X + Y > Z) says the window is now — hardware trajectories put a CRQC at 2028–2035.
Why now
FIPS 203 (ML-KEM), 204 (ML-DSA), and 205 (SLH-DSA) were finalized in August 2024. The migration targets are no longer moving — every delayed migration plan just lost its excuse.
source · NIST FIPS 203/204/205
NSA’s CNSA 2.0 timeline requires post-quantum algorithms across national security systems, with phase-in deadlines through 2033. Defense suppliers inherit the schedule.
source · NSA CNSA 2.0
OMB M-23-02 requires federal agencies to inventory their cryptographic systems and prioritize migration. A cryptographic bill of materials is becoming a procurement artifact.
source · OMB M-23-02
12-24 month window before the broad vulnerability-management incumbents ship a CBOM-native PQC assessment surface. Q exists to occupy that window.
Market
US defense-industrial-base and regulated-finance organizations subject to crypto-inventory mandates — ~4,800 orgs × ~$500K average PQC assessment + migration-planning spend.
estimated from DIB supplier counts + federal/financial mandate scope.
Organizations with a dated mandate (CNSA 2.0 phase-in, M-23-02 inventory) and an estate large enough to need continuous scanning. ~1,600 orgs.
mandate-deadline qualifying filter applied to TAM denominator.
5% of SAM. Blended tier mix across QScout Pro subscriptions and QStrike Enterprise contracts, design-partner beachhead first.
blended plan mix; founder-led + design-partner references.
TBD: confirm hard TAM/SAM figures with founder-approved sourcing spreadsheet before the first investor meeting.
The product
Cryptographic Bill of Materials
Active TLS inspection and certificate analysis across the estate. Produces a full CBOM in CycloneDX 1.7 (JSON/XML) and ingests existing SBOMs, Shodan data, and passive DNS.
HNDL risk quantification
Weighted 7-factor harvest-now-decrypt-later score (0–100) plus a real Mosca inequality evaluation — migration time + data shelf-life vs the CRQC window.
The Board Number
Probability-weighted dollar exposure per CRQC milestone year, built on isolated classic cryptanalysis modeled against quantum capabilities and published hardware trajectories.
Shipped, not slideware
A working scan pipeline on Cloudflare Queues; a native Rust deep-TLS enumeration engine running in a Cloudflare Container; a pure-TypeScript PQC computation layer — 58+ algorithm catalog with NIST/FIPS status, HNDL scoring, Mosca evaluation, and the QStrike financial engine. Plans in market: QRecon Free at $0, QScout Pro at $299/mo, QStrike Enterprise custom — access by request while the private beta runs.
Why we win
Click a wedge to surface the proof point. We log the click in localStorage to see which differentiator lands hardest with investors.
Competitive landscape
The broad vulnerability-management platforms treat PQC as a plugin check; the consultancies go deep once and leave a PDF. Q is the only continuous, CBOM-native option that ends in a dollar figure. Pre-reference we lose to incumbent brand gravity; that’s precisely why design-partner conversion is milestone one.
The ask · interactive
Seed ask
$5.0MM
Target — the right ask
Deep-TLS fleet scale-up + design-partner conversion + QScout Pro GA.
SWOT
Founder
Founder · Operator
Engineering background. Ships the entire Q stack — the Next.js product, the Cloudflare Queues scan pipeline, the Rust deep-TLS engine, and the pure-TypeScript PQC computation layer. Operates a portfolio of shipped products under Wentzel Investments LLC, which is the ship-velocity evidence. Runs founder-led sales into defense and finance design partners.
Founder-led today. Engine and go-to-market hires are the first seed-funded roles.
ryanwentzel.me ↗The wedge is engineering: a scanner that speaks CycloneDX, a Rust engine that enumerates real TLS, and a financial model a board can interrogate — all of it already shipped by one person. Advisor targets, in conversation: a former defense CISO and a cryptography researcher for the algorithm catalog’s governance. The credibility plan rests on shipped software and honest scan output, not on logo walls. Dedicated engine and go-to-market hires are the first seed-funded roles.
The ask
$5MM seed.
Design partner converted to paid by month 5. QScout Pro GA by month 8. First QStrike Enterprise contract by month 12.
We can do it with $3MM (slower) or absorb $15MM (different motion entirely), but $5MM is what fits the wedge.
Investor introductions welcome, and a beta briefing is the fastest way to see the scan pipeline live. Email with one line about your fund focus and the call slot that works for you.