Capabilities
One model, one collection infrastructure, one sector ruler. The deliverables below are cuts of that same architecture, each answering a different decision.
Each layer has its own function and its own state. Separating them is what keeps a capability in validation from reading as a finished product.
The model and the calculation engine. It takes an evidence envelope and returns score, dimensions, contributors, and coverage. It collects nothing on its own.
The infrastructure that observes signals the organization already exposes on the internet. It runs with no agent, credential, or access to internal systems, and hands the evidence envelope to the engine to compute.
The aggregated ruler a result is positioned against. It always compares against anonymous aggregates, never against a third party's individual result.
The packaging of collection and engine into an integrable binary with protected weights. It is what lets the calculation run outside GWK's infrastructure without exposing the intellectual property.
The projection of the effect of declared migration actions. Current and projected state stay on the same ruler, so the delta means something.
Observes the organization's external signals.
Takes
The organization's domains.
Returns
Evidence envelope, with the coverage achieved.
Does not
Complements public evidence with what only the organization knows.
Takes
Inventory, controls, and milestones declared by the organization.
Returns
Enriched envelope, with the origin of each field marked.
Does not
Computes exposure from the envelope.
Takes
Evidence envelope, public or complete.
Returns
Score, dimensions, contributors, and coverage.
Does not
Sets how much each signal contributes and keeps assessments comparable to one another.
Takes
Variance structure of the observable base.
Returns
Weights and transformations applied by the engine.
Does not
Positions the result and translates it into a decision.
Takes
Computed result and aggregated sector ruler.
Returns
Report, comparison, roadmap, or integrable output.
Does not
A reading built from public signals has a defined reach. Declaring that reach is part of the method, not a footnote.
Observed
Public collection saw
Calculated
The IEQ engine derived
Declared
The organization reported
Inferred
The model estimated
Out of scope
Other evidence decides
Access is per account: what shows as available reflects what your organization contracted. What is on the roadmap indicates intended direction, not committed scope.
The executive readout of the organization's quantum cryptographic exposure, computed by the IEQ engine over public-collection evidence. No integration required.
What it delivers
Uses the layers: Public collection · IEQ core
Where the organization stands against peers in the same sector, turning comparison into an order of priority.
What it delivers
Uses the layers: IEQ core · Sector benchmark
Catching regressions before they become accumulated exposure: TLS downgrade, an expiring certificate, or a newly vulnerable cipher.
What it delivers
Intended direction, not committed scope: the items above describe where the capability points, and none of them is available today.
Uses the layers: Public collection · IEQ core
Turns post-quantum migration into measured impact: score today, projected score, and the gain from each governance milestone of the program.
What it delivers
Coverage of the ITI Normative 35/2026 requirements is in validation. The track organizes the program's governance milestones, but it does not yet issue a compliance attestation.
Uses the layers: IEQ core · Governance roadmap
Mapping the cryptographic exposure arriving through the chain of critical suppliers and providers.
What it delivers
Intended direction, not committed scope: the items above describe where the capability points, and none of them is available today.
Uses the layers: Public collection · Sector benchmark
GWK works with two collections. Technical report 2026-S1 publishes 39,903 organizations across 17 sectors under CC-BY, so the method can be reviewed by third parties. The ruler that orders sector comparisons comes from the operational base, with 316,911 companies in run producao_324k_20260712, cut off on July 12, 2026. These are distinct collections with distinct cutoffs: neither is a sample of the other, and results from one do not add to the other.
What this comparison is measured against
Limits of the comparison