What the risk tiers mean

A score of 71 is not an instruction. A tier is. AutoPQC places every scored asset, and every estate, into one of four tiers, and each tier carries an expected action and a place in the migration sequence. This page gives the bands, explains why the boundaries sit where they do, and states what a tier does not authorise.

#Four tiers, four bands

The bands are contiguous and exclusive. Every integer from 0 to 100 belongs to exactly one tier, and no integer belongs to two. There is no band that requires a judgement call about which side of it a score falls on.

The pilot estate scored 75 / 100, which places it in Elevated. Its worst cohorts sat in Acute. An estate tier is a summary of a distribution, so it is always read next to the distribution, never instead of it. See How the exposure score is built for the roll-up arithmetic.

#Why the boundaries sit where they do

Each boundary corresponds to something in the arithmetic, not to a round number chosen for the look of it.

85. Fragility at its maximum contributes 30 points. To clear 85, an asset needs 55 of the remaining 70 available from Horizon, Reachability, Change Cost and Substitution Gap. In practice that requires at least two of them to be high. Acute therefore cannot be reached on a bad algorithm alone, which is the point: a broken primitive protecting nothing, reachable by nobody, is not an emergency.

65. This is the fragility floor. An asset whose primitive is completely defeated and which is meaningfully reachable cannot be tiered below Elevated even if its data is short-lived and the fix is a one-line configuration change. The floor and the band boundary are the same number by construction.

40. Below 40, the score is no longer dominated by fragility. An asset here is usually one whose cryptography is currently sound but whose data will outlive the algorithm’s expected life. That belongs in a review cycle, not in a migration wave.

#The pilot estate, tier by tier

An estate tier of Elevated is a mean. The distribution behind it is what a programme is actually run from. Taking the pilot cohorts from How the exposure score is built and tiering each one gives the shape below. Cohort membership follows the illustrative cohort means used there; the asset counts are the pilot’s real figures.

Two things are worth reading off this. The first wave is 13 assets, not 42, which is what makes a migration programme tractable. The second is that the estate score of 75 sits in Elevated while nearly a third of the estate sits in Acute, so acting on the estate figure alone would understate the urgency. We publish both for that reason. How to read your first exposure report walks through the same distinction on your own data.

#One label, used everywhere

Tier naming is a discipline, not a style choice. We use exactly four labels and we never substitute a synonym for any of them. There is no “moderate”, no “medium”, no “severe”, no colour used as a name, and no numeric severity that has to be mentally converted. If you read Elevated in the console, the PDF report, the CBOM export, an API response or a Posture Attestation, it is the same band, computed the same way.

The reason is auditability. An auditor reading a report from March and a report from October should not have to establish whether two words mean the same thing. The tier vocabulary is fixed for the life of a method major version, and a change to it is a major bump with the notice period described in How the method is versioned.

• Tier names never carry a modifier. There is no “high Elevated” or “borderline Acute”.
• A score is always published next to its tier, so a 65 and an 84 are distinguishable even though both are Elevated.
• Estate tiers and asset tiers use the same four labels and the same four bands.
• Where the fragility floor set the tier, the record says so and shows the unfloored score.

#How assets move between tiers

The useful question about a tier is what it takes to leave it. Because the score is a transparent weighted mean, this is arithmetic rather than guesswork, and the platform shows the arithmetic for the remediation options it proposes.

1. 1

   Deploy a hybrid mode

   A hybrid key establishment that combines a classical group with ML-KEM moves Primitive Fragility down without changing Horizon or Reachability. On our worked TLS example this is the single largest available move, and it is reversible, which is why we usually sequence it first. See Hybrid modes and keeping your rollback.

2. 2

   Replace the primitive outright

   Fragility falls to near zero and Substitution Gap follows it, because there is no longer a substitution outstanding. This is what takes an asset to Contained.

3. 3

   Reduce reachability

   Removing a public path or terminating a transcript inside a controlled boundary lowers up to 20 points. It is a genuine mitigation and it is not a fix, because the underlying primitive is unchanged.

4. 4

   Correct a declared input

   If a retention obligation was overstated at intake, correcting it changes Horizon and may change the tier. This is handled as a recorded override, not an edit. See Why a specific asset was flagged.

Re-scoring happens on the next scheduled run, or on demand after a remediation lands. Historical scores are retained so a tier change has a visible cause and a date, which is what an auditor asks for. What to hand an auditor covers the export format.

#What a tier does not authorise

Tiers are our recommendation about ordering. They are not a decision about your budget, your change freeze or your regulatory position, and they do not carry a date.