Board and executive committee

Prioritizing a transition that does not fit in a single annual budget.

Post-quantum migration will not finish within one investment cycle, and no organization replaces every asset at once. The board's decision is not whether to migrate: it is what goes first, on what criterion, and how that will be demonstrated to whoever asks.

01The decision

Setting the priority order and governance structure of a multi-year program, before internal technical consensus exists and before the threat materializes. It is an allocation decision under uncertainty, and it needs a criterion that survives the departure of whoever championed it.

What is at stake

Prioritizing by technical intuition concentrates investment where attention is highest, not where accumulated exposure is highest.
Without a common ruler, each business unit defends its own urgency and comparison between them becomes a political negotiation.
Long-lived data accumulates exposure while the decision is deferred: what is captured today may be decrypted later.
A program without an initial measurement cannot demonstrate progress later, because no prior state was ever recorded.

02Evidence

On GWK's operational ruler, the median time horizon ranges from 0.21 to 0.96 across the 15 sectors in the engine taxonomy — the highest is 4.5 times the lowest. It is data shelf life, not organization size, that orders structural exposure: the same cryptographic configuration represents different exposures when it protects data that must last for different terms.

On GWK's operational ruler, the median time horizon ranges from 0.21 to 0.96 across the 15 sectors in the engine taxonomy — the highest is 4.5 times the lowest. It is data shelf life, not organization size, that orders structural exposure: the same cryptographic configuration represents different exposures when it protects data that must last for different terms.

Source: GWK operational base, sector aggregates
Date: July 12, 2026
Run: producao_324k_20260712
Population: 316,911 companies in the operational base
Coverage: Public layer only: DNS, TLS, PQC readiness, headers, infrastructure, and observable subdomains.

Limitation: Sector medians describe cohorts, not organizations. A specific company may sit anywhere in its sector's distribution, and the median authorizes no conclusion about it.

03What applies to this decision

Not every GWK capability serves a board. The four below produce material that supports an allocation decision; the rest are technical input and should not reach the boardroom.

Exposure Report

In production

Score, dimensions, top contributors, and coverage for one organization, from public signals.

Sector Benchmark

In production

Relative position against the sector cohort, with percentile and distribution by band.

PQC Readiness Track

In production

Projection of the effect of declared governance actions, always in complete mode.

Portfolio analysis

In production

Comparison across entities of the same group under one ruler and one cutoff date.

04What reaches the board

Reading material, not a monitoring dashboard. GWK does not operate a client portal, and a board does not need one.

Consolidated exposure for the assessed entities, with the collection cutoff date.
Relative position against the sector cohort, with the anonymity floor stated.
Top contributors to the result and the origin of each piece of evidence used.
Coverage per collection module: what was observed and what fell back.
Deepening priorities — where internal analysis is worth spending, and why.
Limitations of the readout, written and not buried in a footnote.

What it depends on

A list of entities and domains to assess, defined by the organization.
Authorization to assess third-party domains, when the scope includes suppliers or subsidiaries.
For complete-mode readouts: internal declaration about data, systems, and governance. There is no form: it is a process run with the GWK team.

05What this readout does not conclude

A board decides better knowing what the evidence does not cover. The columns below separate what was seen from what was derived, and both from what the assessment does not support.

Observed

Public collection saw

Publicly exposed cryptographic configuration.
Domain and subdomain surface reachable from outside.
Post-quantum readiness signals announced during negotiation.

Calculated

The IEQ engine derived

IEQ score and the H, V, E, and M dimensions.
Each signal's contribution to the result.
Percentile against the sector cohort.

Inferred

The model estimated

Data shelf life, from a sector prior, when no declaration exists.
Governance maturity not observable from outside.

Out of scope

Other evidence decides

That the organization is secure, or insecure, in general cybersecurity.
That the absence of a public PQC signal means the absence of an internal initiative.
A date for cryptographic break, nor a probability of attack.
That the result fully represents the organization's internal environment.

What this comparison is measured against

Cutoff date: July 12, 2026
Run: producao_324k_20260712
Population: 316,911 companies
Sectors: 15 sectors in the engine taxonomy
Anonymity floor: K = 30

Limits of the comparison

The ruler is a static reference base, not a continuous measurement: there is no automatic update between one run and the next.
Comparison is always against anonymous aggregates, never against another organization's individual result.
A public-mode result does not compare to a complete-mode result, because the two readings start from different kinds of evidence.

Boundary

Where measurement ends

Adequacy programNot implemented

Measurement ends at: the technical change in the environment. Measuring exposure does not reduce it: reduction requires changing configuration, replacing certificates, switching negotiation policy, or migrating libraries — work carried out by the organization's own teams and suppliers.

This readout delivers

Measured exposure and relative position, with a cutoff date.
A defensible prioritization criterion across units.
Executive material with evidence and limits stated.

After the change, GWK

Re-collects public signals and recalculates IEQ on the same ruler, when contracted to do so.
States scope, mode, coverage, and run for both measurements, so the difference is interpretable.
Attributes the observed effect only to the scope actually changed and verified.

Not included

Executing the change: GWK does not alter the client's configuration, certificates, or infrastructure.
Deployment, assisted operation, or change management.
An adequacy program: it exists as a GWK engineering project, not as a contractable capability.

Start from the real scope

Tell us how many entities the readout covers and which decision it will support. The conversation starts from what can be measured today, with the limits written down before any contract.

Discuss an executive assessment Review the methodology