IEQ products

What GWK built on IEQ.

One model, one collection infrastructure, one sector benchmark. The five products below apply that same measurement to different questions, with maturity and limits stated.

01Products

One measurement, five questions.

The Exposure Report, Sector Benchmark, and PQC Readiness Track are available. Regression Alerts and Third-Party Management are on the roadmap: they indicate intended direction, not committed scope. With an account, what shows as available reflects what your organization has contracted.

Available now

PRODUCT 01In production

Exposure Report

The question

What exposure is observed, and where should the organization start?

A dated assessment of the organization's cryptographic exposure, calculated by IEQ over public-collection evidence: score, dimensions, signal coverage, sector context, and priorities. No integration required. Not an audit or a certification.

What it delivers

  • IEQ score with the contributors that weigh most
  • Observable network evidence, with the coverage achieved
  • Ordered priorities for executive decisions

Uses the layers: Public collection · IEQ core

See a sample report
PRODUCT 02In production

Sector Benchmark

The question

Is the result above, below, or close to the sector norm?

Where organizations, units, or portfolios stand against anonymous sector aggregates, on the same scale and with cutoff date, mode, and coverage stated. It is not a second scoring model and does not expose any third party's individual result.

What it delivers

  • Sector percentile, against anonymous aggregates
  • Distribution and ranking on the operational ruler
  • Comparison across domain portfolios

Uses the layers: IEQ core · Sector benchmark

See the sector benchmark
PRODUCT 03In production

PQC Readiness Track

The question

What does a declared migration milestone change in the result?

Current score, projected score, and the gain attributed to each declared governance milestone of the post-quantum migration program, on the same IEQ scale. The projection does not make changes to the environment.

What it delivers

  • Current score against projected score, on the same ruler
  • Gain attributed per governance milestone
  • Auditable delta action by action

Coverage of the ITI Normative 35/2026 requirements is in validation. The track organizes the program's governance milestones, but it does not yet issue a compliance attestation.

Uses the layers: IEQ core · Governance roadmap

See the PQC Readiness Track

On the roadmap

PRODUCT 04On the roadmap

Regression Alerts

The question

What changed between one collection and the next?

Planned direction: comparing successive collections to flag changes that increase exposure, such as a TLS downgrade, a certificate close to expiry, or a newly vulnerable cipher. There is no continuous monitoring or automated alerting today.

What it delivers

  • Difference between successive collections
  • TLS downgrade
  • Certificate nearing expiry

Intended direction, not committed scope: the items above describe where the capability points, and none of them is available today.

Uses the layers: Public collection · IEQ core

Discuss an assessment
PRODUCT 05On the roadmap

Third-Party Management

The question

What exposure arrives through the supplier chain?

Planned direction: structuring, on an ongoing basis, the cryptographic exposure that arrives through critical suppliers and service providers, with declared criticality and migration blockers. Only a point-in-time assessment of a supplier portfolio from public signals is available today.

What it delivers

  • Reach of exposure per supplier
  • Criticality declared by the organization
  • Migration blockers along the chain

Intended direction, not committed scope: the items above describe where the capability points, and none of them is available today.

Uses the layers: Public collection · Sector benchmark

Discuss an assessment
02Technical layers

The five technical layers behind the products.

Each layer has its own function: the IEQ core calculates, public collection observes, the sector benchmark positions, the appliance packages the calculation for licensed use, and the governance roadmap projects the effect of declared milestones. Keeping them separate is what stops a capability still in validation from reading as a finished product.

IEQ core

In production

The model and the calculation engine. It takes an evidence envelope and returns score, dimensions, contributors, and coverage. It collects nothing on its own.

  • Multiplicative model over horizon, vulnerability, exposure, and governance
  • Score from 0 to 100 with a risk band
  • Explainable contributors per dimension
  • Signal coverage declared alongside the result

Public collection

In production

The infrastructure that observes signals the organization already exposes on the internet. It runs with no agent, credential, or access to internal systems, and hands the evidence envelope to the engine to compute.

  • Observable network and cryptography modules
  • Operation without credentials
  • Coverage measured and reported per collection
  • Conservative fallback where a signal does not appear

Sector benchmark

In production

The aggregated ruler a result is positioned against. It always compares against anonymous aggregates, never against a third party's individual result.

  • Sector aggregation under an anonymity floor
  • Percentile, distribution, and ranking
  • Portfolio comparison
  • Explicit cutoff date and run

Appliance

Internal use · licensing per contract

The packaging of collection and engine into an integrable binary with protected weights. It is what lets the calculation run outside GWK's infrastructure without exposing the intellectual property.

  • Collection and calculation in one binary
  • Protected weights and calibrators
  • Raw output and computed output
  • Auditable usage ledger

Governance roadmap

In production

The projection of the effect of declared migration actions. Current and projected state stay on the same ruler, so the delta means something.

  • Current score against projected score
  • Gain attributed per governance milestone
  • Auditable delta action by action
  • Projection in the same calculation mode as today's score
03Architecture

The path from signal to product.

  1. 01

    Public collection

    Observes the organization's external signals.

    Takes

    The organization's domains.

    Returns

    Evidence envelope, with the coverage achieved.

    Does not

    • Compute exposure
    • See internal systems
    • Use credentials
  2. 02

    Declaratory layer

    Complements public evidence with what only the organization knows.

    Takes

    Inventory, controls, and milestones declared by the organization.

    Returns

    Enriched envelope, with the origin of each field marked.

    Does not

    • Validate declarations on its own
    • Replace collection
  3. 03

    IEQ engine

    Computes exposure from the envelope.

    Takes

    Evidence envelope, public or complete.

    Returns

    Score, dimensions, contributors, and coverage.

    Does not

    • Collect
    • Scan
    • Issue certification
  4. 04

    Statistical calibration

    Sets how much each signal contributes and keeps assessments comparable to one another.

    Takes

    Variance structure of the observable base.

    Returns

    Weights and transformations applied by the engine.

    Does not

    • Score a specific organization
    • Be recalibrated per client
  5. 05

    Benchmark and deliverables

    Positions the result and translates it into a decision.

    Takes

    Computed result and aggregated sector ruler.

    Returns

    Report, comparison, roadmap, or integrable output.

    Does not

    • Compare different rulers
    • Expose a third party's individual result
04Method boundary

What the assessment supports, and what it does not.

A reading built from public signals has a defined reach. Declaring that reach is part of the method, not a footnote.

Observed

Public collection saw

  • Publicly exposed ciphers, protocols, and certificates
  • Network surface reachable from the internet
  • Cryptographic configuration signals of the services found

Calculated

The IEQ engine derived

  • IEQ score from 0 to 100 and risk band
  • Horizon, vulnerability, exposure, and governance dimensions
  • Contributors that weigh most in the result
  • Signal coverage achieved by the collection

Declared

The organization reported

  • Cryptographic inventory and internal controls
  • Governance milestones of the migration program
  • Required confidentiality lifetime of sensitive data

Inferred

The model estimated

  • Adversarial horizon from the nature of the data
  • Conservative fallback where the public signal did not appear
  • Relative position in the sector, against anonymous aggregates

Out of scope

Other evidence decides

  • That the organization was or will be compromised
  • That the cryptographic inventory is complete
  • Attested regulatory compliance
  • The state of systems that expose no public signal
05Provenance

Where the numbers come from.

GWK works with two collections. Technical report 2026-S1 publishes 39,903 organizations across 17 sectors under CC-BY, so the method can be reviewed by third parties. The ruler that orders sector comparisons is the IEQ publication used by the products, with 80,182 companies (run ml_1791394929, ruler generated October 7, 2026). These are distinct collections with distinct cutoffs: neither is a sample of the other, and results from one do not add to the other.

What this comparison is measured against

Ruler generated
October 7, 2026
Run
ml_1791394929
Population
80,182 companies
Sectors
15 sectors in the engine taxonomy
Anonymity floor
K = 30

Limits of the comparison

  • The ruler is a static reference base, not a continuous measurement: there is no automatic update between one run and the next.
  • Comparison is always against anonymous aggregates, never against another organization's individual result.
  • A public-mode result does not compare to a complete-mode result, because the two readings start from different kinds of evidence.

The public catalog shows part of the published records and signals, with sector, year, and publication metadata. Full technical values and complete provenance stay in the authorized product.

Explore the public catalog
IEQ products | GWK Security