The Theos Method.

Weights are integers and sum to 100. They are fixed for the lifetime of this method version.

exposure(asset) = round_half_up(
      0.30 * primitive_fragility
    + 0.25 * confidentiality_horizon
    + 0.20 * reachability
    + 0.15 * change_cost
    + 0.10 * substitution_gap
)

# every dimension is scored 0-100 against the published anchor rubric
#
# fragility floor, applied AFTER rounding, on the integer, never before it:
#   if primitive_fragility == 100 and reachability >= 60:
#       exposure = max(exposure, 65)
#
# the floor only ever raises a score. it is never applied to lower one.

The floor is evaluated after rounding, on the same integer a reviewer reads, not on an intermediate real number nobody sees. An asset whose primitive is completely defeated and which is meaningfully reachable cannot be tiered below Elevated, even when its data is short-lived and the fix is a one-line configuration change. The floor lifts a score to 65 — it never lowers one — and where it binds, the finding record keeps both the computed value and the floored value.

asset       tls-edge-payments-01   (illustrative)
primitive   RSA-2048 key transport, TLS termination at the edge

primitive_fragility     100  x 0.30  =  30.00
confidentiality_horizon  95  x 0.25  =  23.75
reachability            100  x 0.20  =  20.00
change_cost              65  x 0.15  =   9.75
substitution_gap         30  x 0.10  =   3.00
                                        ------
raw                                      86.50
round half-up                            87
fragility floor (65)                     not binding
tier                                     Acute  (85-100)

Fragility and Reachability are both at maximum and together contribute 50 of the 87. Substitution Gap is low because FIPS 203 gives a standardised key-establishment replacement and mainstream TLS stacks already ship a hybrid mode. Change Cost sits mid-band because the cutover has to be coordinated with clients outside this organisation's control. Taking Change Cost to zero would move the asset to 77 — still Elevated. Nothing short of replacing the primitive removes this asset from the migration programme.

The first five cohorts contain the 36 illustrative assets outside Contained. This includes classical weaknesses as well as quantum exposure; it is not a count of 36 quantum-vulnerable assets.

estate = sum(k * n * cohort_mean) / sum(k * n)
       = 6295 / 84
       = 74.940...

round half-up = 75
tier          = Elevated  (65-84)

That is the published 75 / 100. It sits ten points above the floor of Elevated and ten below Acute. The estate tier can change when a sufficiently influential cohort changes. It is a criticality-weighted mean of 42 illustrative asset scores, derived here rather than asserted.

The synthetic example has six assets in Contained and 36 outside it. These tiers are not a binary quantum-vulnerability classification.

• Not a probability. An exposure score of 87 does not mean an 87% chance of anything, and no dimension encodes a belief about an attacker's budget or intent.
• Not a percentage of anything. The scale is 0–100 by construction, not because it measures a share of a whole.
• Not a Q-Day forecast. We do not estimate when a cryptographically relevant quantum computer will exist, and no dimension needs that date to be computed. See Claims we refuse to make, linked below.
• Not a general security rating. The score covers cryptographic exposure to quantum attack only. It says nothing about patch posture, identity hygiene, network segmentation or operational resilience.
• Not comparable across organisations. Two estates with the same score are equally urgent relative to the same rules, not equally at risk in any absolute sense.
• Not a compliance verdict. A tier is a recommendation about sequencing, not a finding that you passed or failed an audit.

Reports issued under theos-method-v0.1 stay pinned to that version. Their scores, tiers and dimension names are frozen as published and are not comparable across this major version bump — replay the underlying estate under theos-method-v1.0 rather than reading figures from the two versions side by side.

1. [01]NIST FIPS 203 — Module-Lattice Key-Encapsulation Mechanism (ML-KEM)
2. [02]NIST FIPS 204 — Module-Lattice Digital Signature Algorithm (ML-DSA)
3. [03]NIST FIPS 205 — Stateless Hash-Based Digital Signature Algorithm (SLH-DSA)
4. [04]NIST IR 8547 (draft) — Transition to Post-Quantum Cryptography Standards
5. [05]NSA CNSA 2.0 — Commercial National Security Algorithm Suite 2.0 & timeline
6. [06]CISA / NSA / NIST — Quantum-Readiness: Migration to Post-Quantum Cryptography factsheet
7. [07]NIST SP 800-57 — Recommendation for Key Management
8. [08]Mosca, M. — Cybersecurity in an era with quantum computers: will we be ready?