QuantumReadyFour situations, one platform
Quantum-safe migration reaches most organisations through a customer, a regulator or an auditor rather than through a technology decision. These are the four ways customers come to us.
You are being asked questions you cannot answer in prose
A bank, a government agency or a large enterprise sends you a security questionnaire with a section on cryptography. It asks which algorithms you use, where they are, and what your post-quantum roadmap is. Your engineering team does not know, because nobody has ever had to produce the list.
What you get
A cryptographic bill of materials per product, with file and line evidence, and a report you can attach to the questionnaire instead of writing paragraphs.
Why it is defensible
Every claim has the code behind it, and every report states what it did not see. A plausible answer that falls apart under questioning is worse than no answer.
An inventory that records algorithm, key length and owner
The MAS advisory of February 2024 asks financial institutions to build crypto-agility and maintain an inventory of cryptographic assets, recording the algorithm, the key length, who owns it, and the system it sits in. That is a register, not a project plan, and it is the part most teams are missing.
What you get
The register, populated from your own code, images, cloud configuration and endpoints, with owner and system fields you fill in once and keep current.
What we do not do
We do not connect to your databases, read business records, or issue anything that claims compliance. The inventory is the evidence, and your attestation is yours.
The three dates are the reason to start, not the reason to panic
By 31 March 2027 a CII owner submits a quantum-safe migration plan to CSA. That plan cannot be written without knowing what cryptography is already deployed, and discovery is the cheapest and most skippable part of the whole exercise.
What you get
Discovery across source, images, cloud configuration and endpoints, then the milestones, waves, owners and policy register the plan needs.
Start where it matters
The Handbook says to begin with your highest risk systems rather than everywhere at once. The workbench does the exposure arithmetic that tells you which those are.
No enterprise programme, and no appetite for one
You have a handful of applications, a cloud account, a few dozen certificates and no dedicated cryptography team. What you need is an honest picture and a short list, not a platform deployment and a professional services engagement.
What you get
Free endpoint and public repository scans to see what is exposed, then a plan when you are ready to look inside your own private code.
What it costs
Nothing to start. The paid plans exist for private repositories, retention and the rollup, and the pricing page says exactly what is in each.