About QuantumReady

An independent service for finding the cryptography an organisation already depends on, and turning that into evidence it can act on and hand to someone else.

Why this exists

Singapore has published dates for quantum-safe migration. The first deadline, March 2027, is a plan submitted to CSA by critical infrastructure owners, and the obligations flow down to their suppliers through procurement. The problem is that almost nobody can answer the first question a plan depends on: which cryptography are we actually using, and where?

That question is an inventory problem, not a hardware problem. It is also the cheapest part of the whole exercise, and the part most likely to be skipped.

What we do

Read source code and configuration and report the cryptography inside it, with file and line evidence.
Open built artifacts and container images, which is where the OpenSSL nobody declared usually turns up.
Measure public endpoints by performing the TLS handshake, so the negotiated key exchange is a measurement and not an inference.
Merge all of that with output from the scanners you already run, so the result is one inventory rather than five.
Turn the inventory into a migration plan: milestones, waves, owners, policy and a vendor register.

What we refuse to do

Every report states what it read, what it skipped and what it cannot see. Beyond that, we do not:

Claim a scan makes anyone compliant. It produces technical evidence, and compliance also needs attestation, documentation and human review.
Pretend to be a vulnerability scanner, a code analysis tool or a hardware vendor. Where those tools are better, we say so and import their output.
Connect to your databases, or read business data. That is a design choice, not a limitation.
Reproduce the CSA Handbook or the Quantum Readiness Index, or play any part in the official assessment.

Independence

QuantumReady is an independent product, built and operated in Singapore. It is not affiliated with, endorsed by, or acting on behalf of the Cyber Security Agency of Singapore, GovTech, IMDA or MAS, and it does not administer the official Quantum Readiness Index. Where we cite a requirement, we link to the published source so you can check it yourself.

Responding to the CSA and GovTech market RFI

CSA and GovTech have issued a Request for Information on Quantum-Safe Market Readiness and Capability, asking the market what products, advisory services and integration capability exist ahead of the CII migration milestones. QuantumReady has prepared its response for the 27 November 2026 deadline, covering our engine, what it can and cannot see, how readiness is measured, and our view of where the market is thin. Where we hold no certification or no customer reference, the response says so rather than leaving the gap to be discovered later.

What that means for a customer: the evidence a bank, an auditor or a CII owner asks you for is the same evidence we produce, because we answered the same questions they did. For a financial institution, it means an inventory that follows the MAS expectation of recording the algorithm, key length and owner of each cryptographic asset, produced in minutes rather than as a services engagement. For a supplier answering a procurement questionnaire, it means a report you can attach instead of writing prose about cryptography you cannot see.

A second opinion, not a rubber stamp

Nothing on this site has been reviewed or approved by CSA or GovTech, and a response to a market consultation is not an endorsement. Where we say we have done something, the artefact is on the site so it can be checked: the coverage page is generated from the rule set, and the sample report is produced live from a public repository.

Who it is for

Technology suppliers, financial services vendors and mid-sized organisations that need to answer quantum-readiness questions from a customer, a bank or a government buyer without starting an enterprise transformation programme. If you need certified hardware, a post-quantum certificate authority or network encryption appliances, you want a hardware vendor and probably a systems integrator. We will say so rather than sell you something adjacent.