PQC SUITE

Step 01 · Discover

CETI-VCC

Discover every piece of cryptography you run, and turn it into a verified inventory you can trust.

Cryptography hides in different places in every estate: in certificates, in configuration, in live connections, in dependencies you inherited years ago. One discovery pass covers all of it.

What comes back is not a raw scan. Every finding carries a stated confidence level, so you can see immediately which parts of your inventory are solid and which need a closer look before you act on them.

• Verified Cryptographic Inventory, exported as a CycloneDX CBOM
• Discovery confidence and coverage, stated explicitly
• Quantum-exposure map
• Deprecated-primitive findings
• Branded PDF report for audit and board use
• Machine-readable handoff into USMC and CADRE

Step 02 · Assess

USMC

Quantify how much cryptographic security margin you actually hold, and what to migrate first.

Almost every tool in this market assesses by severity: flag the weak algorithm, rank by asset criticality, produce a list. That tells you what looks bad. It cannot tell you how much margin you hold, so it cannot tell you when you are done.

USMC reports two complementary outputs. The QRESB Assurance Index is a composite decision-support metric that summarises overall posture for boards, auditors and assurance stakeholders. Where the assessment mode and available evidence support it, the report also states an estimated security margin in bits: a conservative lower bound on attacker work-factor relative to the 128-bit post-quantum threshold, always identified as an estimate and accompanied by its assumptions and evidence confidence.

Where evidence coverage is too low to assess, USMC returns Insufficient Evidence rather than a verdict.

That matters. Security teams have been handed too many confident-looking scores built on incomplete input. Refusing to score is what makes the scores we do produce worth something to an auditor.

Step 03 · Migrate

CADRE

Move systems to quantum-safe cryptography in controlled, reversible waves.

A migration plan is not a migration. CADRE takes your verified inventory and your assurance result and turns them into sequenced work, ordered by risk, dependency and readiness.

Nothing changes on an assumption. Every change can be undone. And after each wave, your assurance position is measured again, so progress is expressed as real movement rather than a count of closed tickets.

• Migration roadmap, sequenced into waves by risk, dependency and readiness
• Dependency verification, tested rather than assumed
• Transactional remediation, with no half-migrated states
• Assurance-margin tracking after each wave
• Migration priority ranking, largest gain per unit effort first
• Enterprise delivery controls: safety gates, canary rollout, dual approval for critical infrastructure