CIO and infrastructure

The cheapest migration is the one that rides a refresh cycle already scheduled.

Replacing cryptography outside a refresh cycle is expensive and competes with the rest of the IT portfolio. Inside a cycle already budgeted, it costs the difference. That makes this less a question of cryptographic urgency and more one of fit: where exposure coincides with an asset already due for replacement.

01The decision

Fitting cryptographic requirements into replacement cycles, supplier contracts, and modernization windows already planned — and identifying where legacy cannot absorb the change and will require its own project.

What is at stake

A cryptographic requirement that arrives after contract signature becomes an amendment or waits for the next cycle.
Supplier dependencies without post-quantum support only surface once migration has already started.
Legacy systems with embedded cryptography are not migratable by configuration and need their own timeline.
Without a view of the real external surface, the internal inventory underestimates what is exposed.

02Evidence

The observable exposure dimension varies little across sectors on the operational ruler: medians sit between 0.5353 and 0.6151 across all 15 sectors. A technology company's public surface looks much like a hospital's — what differs is what that surface protects, and for how long the data must remain secret.

The observable exposure dimension varies little across sectors on the operational ruler: medians sit between 0.5353 and 0.6151 across all 15 sectors. A technology company's public surface looks much like a hospital's — what differs is what that surface protects, and for how long the data must remain secret.

Source: GWK operational base, sector aggregates
Date: July 12, 2026
Run: producao_324k_20260712
Population: 316,911 companies in the operational base
Coverage: Public layer only: DNS, TLS, PQC readiness, headers, infrastructure, and observable subdomains.

Limitation: The observable dimension measures what public collection reaches. Internal environments, private networks, and systems with no public face are not in it, and absence of signal is not evidence of absence of exposure.

03What applies

The useful readout here is one of surface and dependency: what is exposed, what depends on whom, and what public collection can or cannot reach.

Public signal collection

In production

DNS, TLS, PQC readiness, headers, infrastructure, and subdomains, without touching the environment.

Observable dependencies

In production

Where the exposed surface depends on third parties: hosting, CDN, certificate authority, providers.

Declarative analysis

In production

Internal context collection cannot reach: critical systems, cryptographic agility, suppliers.

Appliance

Internal use

Collector and engine packaged into a licensed binary, for execution inside the partner's perimeter.

04What comes out

A map of what is reachable from outside, connected to what the organization declares internally — the two readouts kept separate, never summed.

Inventoried public surface: domains, subdomains, and exposed services.
Cryptographic configuration observed at each reachable point.
External dependencies that carry part of the exposure.
Post-quantum readiness signals already present in negotiation.
Ranked contributors, for fitting into replacement cycles.
Stated coverage per module, with the fallbacks applied.

What it depends on

A list of in-scope domains, including those of units and subsidiaries.
Authorization to assess supplier domains, where applicable.
For the appliance: a licensing agreement and a product layer built by the partner — the binary has no interface of its own.

05What the external readout reaches

Collection observes what an external actor would also observe. That is a friction advantage — it requires no integration — and a scope limitation at the same time.

Observed

Public collection saw

Public-facing services and their cryptographic configuration.
Certification chain and issuing authority.
Infrastructure providers identifiable from outside.

Calculated

The IEQ engine derived

Each exposed dependency's weight in the result.
Aggregate structural exposure of the observed surface.

Declared

The organization reported

Internal systems with no public face.
Contracts, suppliers, and planned replacement cycles.

Inferred

The model estimated

Technologies in use, from public signatures.
Fallbacks when a collection module does not complete.

Out of scope

Other evidence decides

The organization's internal asset inventory.
Cryptography used on private networks and between internal systems.
That a provider with no public PQC signal has no plan.
Cost, timeline, or technical feasibility of a specific replacement.

What this comparison is measured against

Cutoff date: July 12, 2026
Run: producao_324k_20260712
Population: 316,911 companies
Sectors: 15 sectors in the engine taxonomy
Anonymity floor: K = 30

Limits of the comparison

The ruler is a static reference base, not a continuous measurement: there is no automatic update between one run and the next.
Comparison is always against anonymous aggregates, never against another organization's individual result.
A public-mode result does not compare to a complete-mode result, because the two readings start from different kinds of evidence.

Boundary

Where measurement ends

Adequacy programNot implemented

Measurement ends at: the technical change in the environment. Measuring exposure does not reduce it: reduction requires changing configuration, replacing certificates, switching negotiation policy, or migrating libraries — work carried out by the organization's own teams and suppliers.

This readout delivers

A map of the exposed surface and the dependencies behind it.
An order of contributors, for fitting into already-budgeted cycles.
Stated coverage, so you know where the readout is blind.

After the change, GWK

Re-collects public signals and recalculates IEQ on the same ruler, when contracted to do so.
States scope, mode, coverage, and run for both measurements, so the difference is interpretable.
Attributes the observed effect only to the scope actually changed and verified.

Not included

Executing the change: GWK does not alter the client's configuration, certificates, or infrastructure.
Deployment, assisted operation, or change management.
An adequacy program: it exists as a GWK engineering project, not as a contractable capability.

Start from what is already exposed

A public-surface readout requires no integration, credentials, or change window. It shows what an external observer would see today, and serves as the basis for fitting into upcoming cycles.

Map exposure and dependencies Review the methodology