Prioritizing a transition that does not fit in a single annual budget.
Post-quantum migration will not finish within one investment cycle, and no organization replaces every asset at once. The board's decision is not whether to migrate: it is what goes first, on what criterion, and how that will be demonstrated to whoever asks.
Setting the priority order and governance structure of a multi-year program, before internal technical consensus exists and before the threat materializes.
What is at stake
On GWK's operational ruler, the median confidentiality horizon ranges from 0.21 to 0.96 across the 15 sectors in the engine taxonomy.
- Source
- IEQ publication used by the products, sector aggregates
- Date
- October 7, 2026
- Population
- 80,182 companies in the publication used by the products
- Coverage
- Public layer only: DNS, TLS, PQC readiness, headers, infrastructure, and observable subdomains.
Limitation. Sector medians describe cohorts, not organizations. A specific company may sit anywhere in its sector's distribution, and the median authorizes no conclusion about it.
Not every GWK capability serves a board.
Score, dimensions, top contributors, and coverage for one organization, from public signals.
Relative position against the sector cohort, with percentile and distribution by band.
Projection of the effect of declared governance actions, in the same calculation mode as today's score.
Comparison across entities of the same group under one ruler and one cutoff date.
The Exposure Report as reading material for the board: score, factors, coverage, sector context, and priorities.
What you receive
- Consolidated exposure for the assessed entities, with the collection cutoff date.
- Relative position against the sector cohort, with the anonymity floor stated.
- Top contributors to the result and the origin of each piece of evidence used.
- Coverage per collection module: what was observed and what fell back.
- Deepening priorities: where internal analysis is worth spending, and why.
- Limitations of the readout, written and not buried in a footnote.
See the method's limits, the dependencies and where measurement ends
What this readout does not conclude
A board decides better knowing what the evidence does not cover. The columns below separate what was seen from what was derived, and both from what the assessment does not support.
Observed
Public collection saw
- Publicly exposed cryptographic configuration.
- Domain and subdomain surface reachable from outside.
- Post-quantum readiness signals announced during negotiation.
Calculated
The IEQ engine derived
- IEQ score and the H, V, E, and M dimensions.
- Each signal's contribution to the result.
- Percentile against the sector cohort.
Inferred
The model estimated
- Data shelf life, from a sector prior, when no declaration exists.
- Governance maturity not observable from outside.
Out of scope
Other evidence decides
- That the organization is secure, or insecure, in general cybersecurity.
- That the absence of a public PQC signal means the absence of an internal initiative.
- A date for cryptographic break, nor a probability of attack.
- That the result fully represents the organization's internal environment.
What it depends on
- A list of entities and domains to assess, defined by the organization.
- Authorization to assess third-party domains, when the scope includes suppliers or subsidiaries.
- For complete-mode readouts: internal declaration about data, systems, and governance, through the product's optional questions or a process run with the GWK team.
Boundary
Measurement ends at the technical change in the environment. Measuring exposure does not reduce it: reduction requires changing configuration, replacing certificates, switching negotiation policy, or migrating libraries. That work is carried out by the organization's own teams and suppliers. After the change, GWK re-collects public signals and recalculates IEQ on the same ruler, when contracted to do so.
Why measuring does not reduce exposureStart from the real scope
Tell us how many entities the readout covers and which decision it will support. The conversation starts from what can be measured today, with the limits written down before any contract.