Is BNY quantum-safe?
Partly. 34 of 194 public servers under bny.com use post-quantum key exchange, the protection against traffic recorded today being decrypted once a large quantum computer exists. Grade C. Scanned October 18, 2026.
Fix first
Production login, API, VPN, payment and developer servers that still rely on key exchange scheduled for retirement.
- login-bl.bny.com
- mobile-netxpro.bny.com
158 other servers without post-quantum key exchange
- aceportal.bny.com
- aceportal.qa.bny.com
- ai-portal.bny.com
- ai-portal.qa.bny.com
- ai.bny.com
- ai.qa.bny.com
- aiops-rest.bny.com
- aiops-saasrest.bny.com
- alight.bny.com
- alight.qa.bny.com
- apigateway-na.bny.com
- apigateway-na.qa.bny.com
- apigateway.bny.com
- apigateway.qa.bny.com
- apigatewayws.bny.com
- apigatewayws.qa.bny.com
- authenticate.bny.com
- authenticate.qa.bny.com
- authhub.bny.com
- authhub.qa.bny.com
- benpay-demo-gf.bny.com
- benpay-gf.bny.com
- benpay-gf.qa.bny.com
- blackline.bny.com
- blackline.qa.bny.com
- bny.com
- bnymobilercd.bny.com
- bnymrcd.bny.com
- bnymrcd.qa.bny.com
- bnyrcd.bny.com
- bnyrcd.qa.bny.com
- brandcenter.bny.com
- brn.bny.com
- cbx.bny.com
- cbx.qa.bny.com
- cctcfi.bny.com
- cctcfiqa.bny.com
- cctecfi.bny.com
- cctecfiqa.bny.com
- client-exchange.bny.com
- client-reports.bny.com
- cmietf.bny.com
- cmietf.qa.bny.com
- cnjadcgw.bny.com
- cnjnsvpext-gw.bny.com
- compliance.bny.com
- csdirectlink.bny.com
- csdirectlink.qa.bny.com
- dfdisclosure.qa.bny.com
- docs-be.data.bny.com
- docs.data.bny.com
- dwtng.bny.com
- dxl.bny.com
- ebi.qa.bny.com
- econtrib.bny.com
- econtrib.qa.bny.com
- el-eagle.bny.com
- el-eagle.qa.bny.com
- ens.bny.com
- ens.qa.bny.com
- eservices.qa.bny.com
- fi-fix.qa.bny.com
- fsso.qa.bny.com
- fund-prices.bny.com
- fund-prices.qa.bny.com
- gd.bny.com
- gd.qa.bny.com
- globalclearing.bny.com
- gsap.bny.com
- gsap.qa.bny.com
- hlwadcgw.bny.com
- ifxclient2.bny.com
- iic.bny.com
- iic.qa.bny.com
- im-user.bny.com
- im-user.qa.bny.com
- imagearchive.bny.com
- inst.qa.bny.com
- instanttrack.bny.com
- ivr-services.bny.com
- login-bl.qa.bny.com
- login-gr.qa.bny.com
- mcpgateway.qa.bny.com
- metrics.bny.com
- mft-ftx-smft.bny.com
- msvf.bny.com
- msvf.qa.bny.com
- my360-repoindex.bny.com
- my360.bny.com
- my360.qa.bny.com
- mycio.bny.com
- mytoken.qa.bny.com
- navigator.bny.com
- netxservice.bny.com
- nxn-portals.qa.bny.com
- opdesktop.bny.com
- opdesktop.qa.bny.com
- people.qa.bny.com
- privacy.bny.com
- privacy.qa.bny.com
- qvsadcgw.bny.com
- rcd.bny.com
- repoindex.bny.com
- sftheia.bny.com
- sftheia.qa.bny.com
- sg3adcgw.bny.com
- signals.bny.com
- signals.qa.bny.com
- signals2.bny.com
- signals2.qa.bny.com
- slz-invesco.bny.com
- slz-invesco.qa.bny.com
- sp.qa.bny.com
- ssoaas-ap.bny.com
- ssoaas-bny.bny.com
- ssoaas-bnym.bny.com
- ssoaas.bny.com
- ssoaas.qa.bny.com
- ssofadras4-gf.bny.com
- surpasonlinedoc.bny.com
- tasurvey.bny.com
- tasurveytest.bny.com
- tawebchat.bny.com
- tawebchattest.bny.com
- te-nexen.qa.bny.com
- teamshare.qa.bny.com
- tecash.qa.bny.com
- test-as2.sfg.bny.com
- test-mfgw.sfg.bny.com
- tk3adcgw.bny.com
- tlu.bny.com
- tlu.qa.bny.com
- tokensetup.qa.bny.com
- tpcadcgw.bny.com
- tpcnsvpext-gw.bny.com
- trust.bny.com
- trust.qa.bny.com
- vds.bny.com
- vdsportal.bny.com
- vendor-gateway1.bny.com
- vendor-gateway2.bny.com
- vendor-portal1.bny.com
- vendor-portal2.bny.com
- wealth.qa.bny.com
- webexceptions.bny.com
- wm-ofx.bny.com
- wm-ofx.qa.bny.com
- wokadcgw.bny.com
- woveconnect.bny.com
- wpauth.bny.com
- wpauth.qa.bny.com
- wvr.qa.bny.com
- www-ai.bny.com
- www-netxservice.bny.com
- xat-nexen.bny.com
- xat-pershingx.bny.com
- xml-netxpro.bny.com
- ymasmadaptor.qa.bny.com
34 servers already protected
- apigatewaypx.bny.com
- apigatewaypx.dev.bny.com
- apigatewaypx.qa.bny.com
- client.bny.com
- client.qa.bny.com
- clip.bny.com
- ct-exhibits.bny.com
- ct-exhibitsuat.bny.com
- data.bny.com
- dev.data.bny.com
- developer.bny.com
- developer.qa.bny.com
- ecrm-dev.bny.com
- ecrm-hotfix-uat.bny.com
- ep-gf.bny.com
- ep-gf.qa.bny.com
- login-p.bny.com
- login.bny.com
- login.qa.bny.com
- mycio.qa.bny.com
- nexen-pulse.bny.com
- nexen-pulse.qa.bny.com
- nexen.bny.com
- nexen.qa.bny.com
- pioneer.qa.bny.com
- rcd.qa.bny.com
- research.bny.com
- sma.qa.bny.com
- stage.data.bny.com
- uae.data.bny.com
- uae.dev.data.bny.com
- uat.bny.com
- www.bny.com
- xat-cooke.ws.qa.bny.com
What this means
NIST has scheduled the key exchange most servers still use for retirement: deprecated after 2030, disallowed after 2035 (NIST IR 8547). Traffic recorded today can be decrypted once a large quantum computer exists. A server that offers hybrid ML-KEM key exchange closes that today; a server that does not is still open to harvest now, decrypt later.
Hostnames come from public certificate logs plus common service names, kept where the name resolves to a public address, and each is tested from the outside with post-quantum-only TLS 1.3 handshakes. A hostname shows what a server is called, not what traffic it carries; internal systems are out of scope. Method.
Work at BNY?
Fleet Watch gives you this scan privately every week, with your suppliers and a report your auditor can verify. The first scan is free.
Scan your own domainBadge
Shows the current grade and updates itself. Anyone may embed it.
<a href="https://latticescan.com/readiness/bny.com"><img src="https://latticescan.com/badge/readiness/bny.com" alt="quantum readiness"></a>