Post-quantum cryptography services

Before you can migrate to post-quantum cryptography, you need to know exactly what cryptographic assets you have, where they are, and what they protect. Most organisations have no single inventory of this — cryptographic algorithms, keys, certificates and protocols are scattered across networks, applications, infrastructure and third-party systems.

The PQC Discovery & CBOM service builds that inventory. Using a combination of active scanning, passive observation, configuration analysis and stakeholder interviews, Qontomcrypt produces an evidence-led Cryptographic Bill of Materials — a structured, machine-readable record of every cryptographic asset in scope.

Knowing what cryptographic assets you have is only the first step. The Quantum Risk Assessment applies a structured scoring model to every asset in the CBOM — producing a defensible Priority Score and a clear P1–P4 migration sequence.

The assessment is built on five factors that together determine how urgently each cryptographic asset needs to be migrated. Each factor is scored 1–5 and combined into a weighted Priority Score from 0–100. The model is designed to be transparent, auditable and defensible — not a black-box risk rating.

A Priority Score tells you what to migrate first. The PQC Migration Roadmap tells you how — with a structured, wave-based remediation plan that accounts for dependencies, ownership, resource constraints and regulatory timelines.

The roadmap translates the Priority Score output into a sequenced migration programme. It identifies the systems, teams and vendors involved in each migration wave, maps cryptographic dependencies to avoid breaking changes, and produces the executive reporting needed to secure budget and board-level commitment.

For organisations with long-lived, high-value data that cannot wait for a full enterprise migration programme, the PQC Data Protection Platform provides targeted quantum-resistant protection — deployed in your own environment, with encryption keys that never leave your control.

The platform applies NIST-standardised post-quantum algorithms to protect data at rest — prioritising the archives most at risk from harvest-now-decrypt-later attacks. It is designed for deployment in regulated, data-intensive environments where data residency, key custody and audit requirements are non-negotiable.

Quantum risk is not static. The threat timeline evolves, new vulnerabilities are discovered, vendors update their cryptographic configurations, and migration programmes introduce new assets alongside legacy ones. Ongoing monitoring ensures your quantum readiness posture reflects the current state of your environment — not a point-in-time snapshot.

The CBOM Monitoring & Quantum Readiness service provides continuous visibility into your cryptographic estate — tracking changes, monitoring vendor readiness, measuring remediation progress and alerting on new quantum-vulnerable assets introduced through system changes or third-party updates.