The AutoPQC assessment methodology.
Deterministic, evidence-grounded, NIST-aligned. Every point in an AutoPQC risk score traces to a specific cryptographic fact — the AI explains findings, it never invents them. This page is the canonical public formula; when it changes, the version bumps and previously issued reports stay pinned to the version they were generated against.
§01 · Principles
Why the score can be trusted.
Deterministic
Rule-based scoring, not a black box. Same estate, same score — two independent runs reproduce identical results.
Version-stamped
Every report freezes its methodology version. A 2026 report can be replayed under 2026 rules years later.
Explainable AI
The classifier assigns categories with calibrated confidence (95.2% accuracy, 0.94 macro-F1 on validation); the narrative layer only describes what the rules found.
Peer-reviewable
The full factor table and weights are on this page. Corrections are welcome — versioned responses are published.
§02 · Scoring engine
Five factors, one hundred points.
Each discovered cryptographic asset is scored 0–100 as the weighted sum below, then ranked across the estate to produce the migration sequence.
| Factor | Weight | Rule |
|---|---|---|
Algorithm family & strength algorithm_family | 30 | Quantum-broken public-key primitives (RSA, ECDSA, ECDH, DSA) score highest risk; sub-112-bit parameters escalate further. AES-256 / SHA-384 score minimal. |
Protected-data longevity data_longevity | 22 | Risk scales with how long the protected data must remain confidential relative to the migration window (harvest-now-decrypt-later exposure). |
Exposure surface exposure_surface | 18 | Internet-facing endpoints and third-party integrations outrank internal-only usage; key material reachable from untrusted networks escalates. |
Migration difficulty migration_difficulty | 16 | Hard-coded algorithms, vendor lock-in and protocol constraints raise the score; crypto-agile abstractions lower it. |
Operational criticality operational_criticality | 14 | Business impact of the dependent system — revenue path, safety, regulatory scope — weights the final ranking. |
Weights sum to 100. The estate-level risk score is the asset-count-weighted aggregate — the demo estate on this site surfaces 75/100 from 42 discovered assets, 36 of them quantum-vulnerable.
§03 · Tier mapping
What a score means in practice.
Monitor. Re-scan on infrastructure change.
Plan migration within 24 months.
Migrate within 12 months; consider hybrid schemes now.
Migrate immediately — long-life data on this path is effectively pre-harvested.
§04 · Validation
Measured, not promised.
Numbers below are from AutoPQC's validation runs and the reference estate demo — the same figures shown across this site, from a single source of truth.
95.2%
AI classification accuracy on validation set
0.94
macro-F1 across asset categories
22H → 14M
manual discovery time vs. AutoPQC, reference estate
§05 · Cite this methodology
Open and citable.
Theos Quantum Technologies. (2026). AutoPQC Assessment Methodology
(Version 0.1) [Methodology specification]. https://www.theosquantum.com/methodology§06 · References
- [01]NIST FIPS 203 — Module-Lattice Key-Encapsulation Mechanism (ML-KEM)
- [02]NIST FIPS 204 — Module-Lattice Digital Signature Algorithm (ML-DSA)
- [03]NIST FIPS 205 — Stateless Hash-Based Digital Signature Algorithm (SLH-DSA)
- [04]NIST IR 8547 (draft) — Transition to Post-Quantum Cryptography Standards
- [05]NSA CNSA 2.0 — Commercial National Security Algorithm Suite 2.0 & timeline
- [06]CISA / NSA / NIST — Quantum-Readiness: Migration to Post-Quantum Cryptography factsheet
- [07]NIST SP 800-57 — Recommendation for Key Management
- [08]Mosca, M. — Cybersecurity in an era with quantum computers: will we be ready?