Post-quantum readiness check
When a bank, a ministry or a US agency asks you about post-quantum cryptography, you need an answer that holds up. We check what your systems use today, tell you which rules apply to you and by when, and hand you a plan and a statement you can send. The external snapshot is free; the full assessment has a fixed scope and price.
When companies need it
- A customer’s security questionnaire asks for your “PQC migration plan” or “cryptographic inventory”, and you have neither.
- A tender or a contract with a bank (DORA), a public body or an essential entity (NIS2) asks how you will meet the EU timeline: inventory by 2026, critical systems by 2030, everything by 2035.
- You sell to the US federal government and the post-quantum FAR rule is coming.
- Your board or your CISO wants to know where you stand before someone asks.
External snapshot
What anyone on the internet sees of you. Within 2 working days.
- Every public hostname of your domains, from Certificate Transparency logs and your own list
- For each one: TLS version, post-quantum key exchange or not, certificate type and expiry, and who terminates TLS (your server, a CDN, a WAF)
- Your mail servers
- A short list of what to fix first
Free because it is automated. Ask for it for your own domains.
Full assessment
The outside, the inside, and a plan you can show. 5 working days.
- The external snapshot, plus the SSH and VPN endpoints you name
- A cryptography inventory of up to three code repositories (CycloneDX CBOM): which libraries and algorithms you use and where, so you know what has to change
- Which deadlines apply to you and what they require: EU roadmap, NIS2 as your country transposed it, DORA, BSI, ANSSI, NCSC, US M-26-15
- A 12-month migration plan: quick wins, what to ask each vendor, what can wait for standards
- A one-page readiness statement written for customer questionnaires, signed by us as the independent assessor (a self-assessment, not a certificate)
- A 60-minute walkthrough with your team
What the report looks like
An illustrative extract for a made-up company, example.com:
| Endpoint | Today | Post-quantum | What to do |
|---|---|---|---|
| www.example.com | TLS 1.3 via Cloudflare | Yes | Nothing; Cloudflare already offers X25519MLKEM768. |
| api.example.com | TLS 1.2 only, cloud load balancer | No | Enable TLS 1.3 and the hybrid group in the balancer’s TLS policy; a configuration change, then retest. |
| vpn.example.com | IKEv2, classic Diffie-Hellman | No | Ask the vendor for its ML-KEM release date; it decides your 2030 milestone. |
| mail (MX) | STARTTLS, TLS 1.3, X25519 | No | Hosted mail; nothing to change on your side, note it in the statement. |
Why not do it in-house
The outside part you can: tools like testssl.sh and crt.sh are free, and so is our snapshot. What takes time is the inside: finding every place your code and your vendors use RSA or elliptic curves, working out which deadlines bind you and what an auditor will expect, and writing it up so that a bank’s or a ministry’s security team accepts it. That last part is why customers ask for an assessment from someone outside the company.
How it works
- Write to max@sushch.uk with your domains and, if you want the full assessment, what your customer asked. For the full assessment we agree the scope in a short call.
- You get an invoice in EUR or USD. We sign your NDA if you need one.
- Only passive checks from the outside, the same ones a browser or a mail server makes. Code is read only if you share it, and stays with us.
What it is not
Not a penetration test and not a certification. It tells you where you stand and what to do next, with the evidence to show a customer.
Done by Maksym Sushchuk, who measured the post-quantum readiness of EU government websites.