What AutoPQC actually does

AutoPQC answers one question: where is the cryptography in your estate, and how much of it fails once a cryptographically relevant quantum computer exists. It answers with four artefacts — an inventory, a score, a standards mapping, and a measured performance figure. This page explains each of them, in the order the platform produces them, and states plainly where the platform stops.

If you read one page in this Knowledge Base, read this one. Everything else is detail hanging off the four artefacts described below.

#The problem, stated precisely

Most large organisations cannot produce a complete list of the cryptographic algorithms running in production. This is not negligence. Cryptography in an estate of any age was deployed by dozens of teams over fifteen or twenty years: TLS terminators, service meshes, database encryption, code-signing pipelines, VPN concentrators, HSM-held keys, hard-coded library calls, third-party appliances nobody has logged into since the vendor left. No single system owns it, so no single system can list it.

That matters because the post-quantum transition is an inventory problem first and a cryptography problem second. NIST published FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) in August 2024, so the replacement algorithms are settled. The NSA's CNSA 2.0 timeline and the EU's DORA regime (applicable from 17 January 2025) set the schedule pressure. What is not settled, inside almost any enterprise, is the list of things that need replacing.

AutoPQC exists to produce that list, rank it, and tell you what changing each item will cost you in latency and throughput. It is a decision-support platform for a multi-year migration programme, not a scanner you run once.

#The four things the platform does

1. 1

   Discover

   Detectors read the places cryptography is declared and configured — source repositories, build manifests, TLS endpoints, certificate stores, key-management inventories, configuration management, and exported appliance settings. Each finding becomes an asset with a provenance record: which detector saw it, in which artefact, at which revision. See How discovery finds cryptography.

2. 2

   Score

   Every asset receives an exposure score from 0 to 100, and the estate receives an aggregate. The score is built from named inputs with published weights — algorithm family, key length, protocol context, data lifetime, exposure surface, and remediation difficulty. The weights are not a secret. They are documented in The inputs, the weights, and where they come from.

3. 3

   Map

   Each vulnerable asset is mapped to the NIST replacement that applies to it: key establishment to FIPS 203, general-purpose signatures to FIPS 204, long-lived or firmware signatures to FIPS 205. The mapping is explicit per asset rather than a blanket recommendation. See FIPS 203, 204 and 205, mapped to output.

4. 4

   Prove

   Before a change is scheduled, AutoPQC measures the candidate replacement against the current primitive on representative traffic and reports handshake latency, payload growth and throughput. A migration that halves your transaction rate is not a migration you can ship. See Proving the performance impact.

Those four steps run in that order for a reason. Scoring an incomplete inventory produces a confident number about the wrong estate. Mapping before scoring produces a remediation backlog with no priority. Shipping before measuring produces a rollback.

#What comes out of it

The platform is deliberately artefact-oriented. Each output is something a named person can act on, hand to an auditor, or check into a repository.

#The explainability requirement

Machine learning is used for classification and prioritisation, not for the final word. Every flag carries the evidence that produced it: the detector, the file or endpoint, the matched pattern, the inputs that moved the score, and the weight each input carried. An engineer who disagrees with a finding can see exactly what the model saw.

This is a design constraint rather than a feature. A cryptographic migration is a change-control conversation with people who are accountable for uptime. A score that cannot be traced back to an observation will be ignored, and it deserves to be. Why a specific asset was flagged walks through a single finding end to end.

#The numbers we have, and what they cover

The figures below come from one pilot run against one real estate. They are the only product performance numbers we publish, and we publish them with their limits attached.

Cryptographic assets discovered

42

Assets classified vulnerable

36

Aggregate estate risk score

75 / 100

Manual review time on that estate

22 hours

AutoPQC review time on the same estate

14 minutes

Classification accuracy

95.2%

Macro-F1 on the labelled evaluation set

0.94

One estate is not a benchmark. A 42-asset estate is small, and the accuracy figure describes performance on our labelled evaluation set rather than a guarantee about yours. How to read your first exposure report takes these same numbers apart figure by figure, and Reproducing our numbers documents how the run was set up.

#What AutoPQC does not do

• We do not break cryptography. No exploitation, no cryptanalysis against your systems, no proof-of-concept attacks.
• We do not claim a Q-Day date. We publish the arithmetic of the migration window and let you set your own assumptions. See Claims we refuse to make.
• We do not find every asset. Discovery has documented blind spots, including closed appliances that expose no configuration and cryptography reachable only at runtime. Read What discovery will not do before you treat an inventory as complete.
• We do not sell you post-quantum hardware or a replacement TLS stack. We tell you which standard applies and what the change costs.

#Where to go next

This category is ordered as a reading path. If you are evaluating whether AutoPQC fits your organisation at all, the next page is written to talk some readers out of it.

1. 01Who this is for, and who it is not — the disqualifying criteria, stated first.
2. 02What to have ready before we start — access, scope and the people you will need.
3. 03What the first thirty days look like — the week-by-week shape of a Baseline Assessment.
4. 04How to read your first exposure report — a worked example using the pilot figures.
5. 05The Theos Method, in outline — the published method behind the scoring, also available at /methodology.