Free Tool · Quantum Security
PQC Cryptographic Risk Assessment
Answer nine questions about your organisation's environment and receive an instant risk score with qualifier context. No account required. An anonymous submission option. Results appear on this page at the end of the survey, no email is required.
Your answers are processed entirely in your browser. No data is sent to any server unless you choose to submit the optional report form. No IP address, device information, or browsing data is collected at any stage.
How this assessment works
This tool scores your organisation's exposure to post-quantum cryptographic risk across five factors, adjusted for your sector. Three qualifier questions then modify the recommendations based on your current preparedness, supply chain dependency, and board awareness.
Cryptographic Exposure measures how much of your security depends on encryption that quantum computers could break. This includes VPNs, PKI certificates, secure communications, and any system using RSA or elliptic curve cryptography.
Data Longevity measures how long your sensitive data must remain confidential. State-level adversaries are already collecting encrypted data today for future decryption when quantum computers become capable.
Trust Dependence measures how much your organisation relies on digital signatures, certificates, firmware signing, or secure boot chains to prove that software, devices, and documents are genuine.
Regulatory Pressure measures how much external compliance pressure exists, including NIST PQC standards, NIS2 director liability, sector regulations, and customer procurement requirements.
Migration Difficulty measures how hard it will be to actually change your encryption. Modern cloud systems update relatively easily. Legacy systems, embedded devices, and hardware security modules may require physical replacement.
The model reflects the risk factors identified in NIST's post-quantum cryptography migration guidance and Steven Vaile's advisory experience across government, defence, and critical infrastructure organisations.
Tell us about your organisation
Country and sector adjust the scoring weights to reflect the risk profile of your environment. Neither is stored. Results run entirely in your browser.
We ask for your country to recommend relevant quantum security service providers and consultancies in your region. Your country does not affect your risk score.
Your sector determines how the five risk factors are weighted. Different industries face different quantum risk profiles. For example, defence organisations have higher exposure and trust dependence weights, while healthcare organisations have higher data longevity weights.
Weight distribution for this sector:
These percentages show how your sector's risk profile weights each factor. A higher percentage means that factor has more influence on your overall score. The weights are based on sector-specific risk patterns identified in NIST's post-quantum cryptography migration guidance.
This answer helps us tailor your recommendations. No IP address or device data is collected.
How much of your security depends on encryption that quantum computers could break?
We ask this because quantum computers will be able to crack certain types of digital locks (called public-key encryption) that protect most business systems today. The more your organisation relies on these locks, the more you will need to replace. If you are unsure, think about how many secure connections, certificates, or encrypted communications your organisation manages directly.
This answer helps us tailor your recommendations. No IP address or device data is collected.
How long must your sensitive data remain confidential?
How long does your most sensitive information need to stay secret? Think about customer records, contracts, intellectual property, or government data. If someone stole your encrypted data today and could read it in five years, would that matter? If unsure, consider what happens if your oldest important records were exposed.
This answer helps us tailor your recommendations. No IP address or device data is collected.
How much does your organisation rely on long-lived signatures, certificates, firmware signing, or trust chains?
How much does your organisation rely on digital certificates, signatures, or secure boot systems to prove things are genuine? These are the digital seals that confirm software updates are real, devices are authentic, and documents have not been tampered with. If unsure, ask your IT team how many certificates your organisation manages.
This answer helps us tailor your recommendations. No IP address or device data is collected.
How much external compliance or customer pressure exists around quantum readiness?
Is your industry being asked to prepare for quantum risk? Government agencies, financial regulators, and defence procurement teams are already asking suppliers about their quantum readiness plans. If unsure, check whether your sector has received guidance from NIST, NCSC, or ENISA on post-quantum cryptography.
This answer helps us tailor your recommendations. No IP address or device data is collected.
How difficult will it be for your organisation to migrate to quantum-safe cryptography?
How easy would it be to update your security systems? Modern cloud services can usually update quickly. But if your organisation runs older systems, embedded devices, factory equipment, or hardware that cannot be remotely updated, the migration will take longer and cost more. If unsure, think about the oldest system in your organisation that handles sensitive data.
This answer helps us tailor your recommendations. No IP address or device data is collected.
What is your organisation's current state of PQC preparedness?
Have you started preparing for quantum risk? This helps us understand how urgent your next steps are. An organisation that has already completed a cryptographic audit needs different guidance from one that has not yet discussed quantum risk at board level.
This answer helps us tailor your recommendations. No IP address or device data is collected.
How dependent is your organisation on third-party vendors for cryptographic infrastructure?
How much of your security depends on other companies? If your key vendors have not started their own quantum migration, your organisation inherits their risk regardless of your own preparedness. If unsure, consider whether you could answer confidently if a customer asked about your supply chain's quantum readiness.
This answer helps us tailor your recommendations. No IP address or device data is collected.
What is your board's current level of engagement with PQC risk?
Has your board been briefed on quantum risk? Board awareness determines how quickly your organisation can act. NIS2 regulations create personal liability for directors on cybersecurity matters, making this a governance question, not just a technical one.
This answer helps us tailor your recommendations. No IP address or device data is collected.
Get your detailed risk report
Your results were calculated in your browser. No data is stored until you submit this form.
About this model
This assessment uses a five-factor weighted model reflecting the core drivers identified by NIST's post-quantum cryptography migration guidance and Steven Vaile's advisory experience: cryptographic exposure, data longevity, trust dependence, regulatory pressure, and migration feasibility. The weights are derived from their relative contribution to overall quantum cryptographic risk at an organisational level.
Selecting a sector adjusts the weight distribution to reflect that industry's risk profile. Defence environments carry higher exposure weight; pharmaceutical and healthcare organisations carry higher data longevity weight; legal and financial services carry higher regulatory pressure weight.
Three qualifier steps — current preparedness, supply chain dependency, and board awareness — provide context that adjusts recommendations without altering the scored risk percentage. They distinguish between organisations facing the same exposure at different stages of response.
It is designed as a risk triage tool, not a full engineering audit. Organisations scoring in the High or Critical bands should begin with a cryptographic bill of materials (CBOM) to enumerate their quantum-vulnerable assets before any remediation planning.
For a comprehensive cryptographic inventory and migration roadmap, contact Steven.