Service 04 · Post-quantum transition
Are we ready for quantum?
The post-quantum transition is the replacement of the key exchange that protects every encrypted connection with one a quantum computer cannot break. For one host it is measured in a second on this site; for an estate of thousands it is a plan, host by host, in the order that matters. This page says what is true outside, what the question means inside, and how the work is put in order.
Measure one host now The Florida study: 81 institutions, every one named
01 / The world outside
The world outside: record now, read later
No quantum computer able to break today’s encryption exists. The threat is that traffic recorded today will be readable on the day one does: "harvest now, decrypt later." That is a confidentiality problem, and it lives in the key exchange, the step where two parties agree on a secret, so it is the key exchange that must change first. NIST published the replacement, ML-KEM, as FIPS 203 in August 2024, and its transition guidance, IR 8547, deprecates the current key exchange from 2030 and disallows it in 2035. Browsers, OpenSSL and the large content networks already negotiate the hybrid exchange on every connection that supports it.
The fix is small and unevenly applied. When Quantum Ready Labs scanned Florida’s eighty-one banks and credit unions in October 2026, fifty-four already protected their customers’ connections and twenty-seven did not yet; the median score was eighty-five, and the institutions that were not yet protected were, in most cases, one setting away. Certificates are a separate matter: a signature cannot be forged retroactively, and the public web has no post-quantum roots yet, so nothing on that side can be acted on today, and an honest report says so.
02 / The world inside
The world inside: a question with a date on it
Most executives first meet this question from the outside: a customer’s questionnaire, a regulator’s letter, a director who read about it. The discomfort it brings is of a particular kind: the threat is real, the date is published, the physics is beyond the room, and nobody inside can say with confidence which of the organization’s thousand hosts are protected and which are not. It feels like a research problem. It is an inventory problem, and inventory problems are solved.
What the executive needs is not a position on quantum computing but a list: every public host, where each one stands today, and the order in which to move the ones that are not yet protected, with the oldest and most sensitive data first, because that is the traffic worth harvesting. Once the list exists, the question changes from "are we ready" to "we are protected on these, these are scheduled, and this is the date we will be done," which is a sentence a board can hear and a regulator can file.
03 / Putting it in order
Putting it in order: how the work is done
The first measurement takes a second and costs nothing: the field at the top of this site scans one host with fourteen handshakes, exactly as a browser would, and returns a stage, Exposed, At risk, Protected or Ready, a score and the one next step. For an estate, the same scanner runs over every public host from the organization’s own inventory, its DNS and its certificates, and the result is a table: host by host, the stage, the server or edge that terminates its connections, and the setting that would move it.
The plan follows the table. Hosts are grouped by what terminates them, a load balancer, a CDN, a web server, because a setting on one of those moves many hosts at once; groups are ordered by the sensitivity and the age of the data they carry; each group gets an owner, a change and a date, and the change is verified with the same scanner the day it is made. The report to the board is the table before and after, the certificates and legacy key transport still to retire, and the date by which the estate is protected against harvesting, well before 2030. The first inventory and plan for an estate of a few thousand hosts takes three to four weeks.
What comes back
- An inventory of every public host, from the organization’s records, its DNS and its certificates
- Each host measured: stage, score, what terminates it, the setting that moves it
- Hosts grouped by what terminates them, ordered by the sensitivity and age of their data
- A plan with an owner, a change and a date per group, verified by the same scanner
- The report to the board: before and after, what remains, the date the estate is protected
- The open-source scanner itself, so the measurement can be repeated by anyone
The work, as delivered
Pages and screens from the samples on this site. The Florida study: 81 institutions, every one named.
The question, one field: are you quantum ready?
Protected, 85: hybrid post-quantum key exchange accepted
At risk, 49: one setting away
The same scan over an inventory, from the terminal
The first step
Type a host name at the top of the home page and read where it stands in a second. For the estate, tell us roughly how many hosts.