You already know what you have. What is missing is the ruler that orders what comes first.
Cryptographic inventory, scanning, and environment knowledge answer what exists and where. None of them alone produces a measure that is comparable across units, against the sector, and over time. That measure is what is missing when the board asks for an execution order.
Choosing, among hundreds of known cryptographic dependencies, which enter the next cycle, and defending that choice before a committee that does not read handshakes.
What is at stake
In finance, the ruler's median is 66.3: half of the sector's 7,574 organizations sit between 62.2 and 68.2.
- Source
- IEQ publication used by the products, finance cohort
- Date
- October 7, 2026
- Population
- 7,574 organizations in the finance sector
- Coverage
- Public layer only: DNS, TLS, PQC readiness, headers, infrastructure, and observable subdomains.
Limitation. Quartiles describe the cohort at the cutoff date. A specific organization may sit outside the range, and an individual readout requires its own assessment. The cohort does not substitute for it.
Two of these items are on the roadmap and should not enter planning as though they existed.
A readout with no credentials, agent, or integration, including environments you have no access to.
Percentile and band distribution against the sector, on the same ruler and cutoff date.
Projection of the effect of declared actions, with current and projected state on the same ruler and in the same calculation mode.
Difference between collections, TLS downgrade, expiring certificates. Product direction, not contractable scope.
Exposure arriving through the supplier chain. Product direction, not contractable scope.
Technical output from the Exposure Report with provenance preserved: every number carries origin, run, and coverage, so the result can be checked rather than taken on trust.
What you receive
- Score, level, and the four dimensions, with the calculation mode stated.
- Ranked contributors, with the evidence origin for each.
- Coverage per module and the fallbacks the model applied.
- Comparison against the sector cohort and the corresponding percentile.
- A PDF report for internal circulation.
- Governance projection in complete mode, when a declaration exists.
See the method's limits, the dependencies and where measurement ends
The method's boundary
IEQ does not replace cryptographic inventory, security architecture, or internal assessment. It measures one specific thing, and the separation below is what makes the readout usable in a technical discussion.
Observed
Public collection saw
- TLS versions, suites, and publicly negotiated parameters.
- Certificates, chains, and issuance policies declared in DNS.
- Security headers and announced PQC readiness.
- Subdomains reachable through public sources.
Calculated
The IEQ engine derived
- Structural HNDL exposure on a common scale.
- Relative weight of each signal in the result.
- Risk band and position in the sector distribution.
Declared
The organization reported
- Secrecy shelf life by data category.
- Critical systems and dependency on Shor-vulnerable cryptography.
- Cryptographic agility and governance posture.
Inferred
The model estimated
- Sector prior for shelf life, when no declaration exists.
- Model-defined fallbacks when a module fails.
Out of scope
Other evidence decides
- A cryptographic inventory of the internal environment.
- Conventional vulnerabilities: a low IEQ does not mean their absence.
- Comparison between a public and a complete result: they are different rulers.
- A supplier's internal posture from its public surface.
What it depends on
- The organization's domains, or express authorization from the owner.
- For complete mode: a declaration covering sensitive data, critical systems, cryptographic agility, and governance.
- A defined owner for validating what is declared: the engine consumes the data, it does not audit it.
Boundary
Measurement ends at the technical change in the environment. Measuring exposure does not reduce it: reduction requires changing configuration, replacing certificates, switching negotiation policy, or migrating libraries. That work is carried out by the organization's own teams and suppliers. After the change, GWK re-collects public signals and recalculates IEQ on the same ruler, when contracted to do so.
Why measuring does not reduce exposureBring a scope, not an RFP
Tell us which domains are in scope, whether the readout needs to be public or complete, and which decision it will support. If what you need is on the roadmap, we say so in the first conversation.