Risk quantification

What is risk quantification?

Quantum-risk quantification turns cryptographic inventory into migration priority using algorithm exposure, data sensitivity, confidentiality lifetime, exploitability and dependency context.

A raw inventory does not tell an organization what to migrate first. A useful model exposes the inputs, weighting and uncertainty behind its priorities.

Questions to ask a vendor

1. Is harvest-now-decrypt-later exposure modeled?
2. Can a buyer inspect the score inputs and weights?
3. Does priority account for data lifespan and migration dependency?

What this edition actually supports

Weight 3 of 19. Can an inventory support a defensible migration order?

Useful prioritization ties crypto exposure to algorithm, key/certificate state, reachable use, data lifetime and operational context, and makes assumptions visible. QScout scores 9 in the dated rubric. CBOM Secure's current V1.1 page describes a 0–100 score and its connected-source limits; that current cited page does not silently revise its 2026.7 cell. A risk number is a model output, not a measured breach probability.

How to investigate this criterion

Read the scoring rationale, source date, missing inputs and a case where the priority would change.

Primary and original inputs: pqc-index.org · www.encryptionconsulting.com. Review all dated cell source checks and the 1 October per-cell limits.

The 2026.7 cells below are public-evidence scores. A vendor page documents a claim; an artifact check tests only its stated scope. Missing product execution and inaccessible sources remain explicit unknowns. The score snapshot has not been recomputed from later pages.