Know which systems to make quantum-safe
first, and show exactly why.
QRAM assesses quantum risk asset by asset, across every factor that shapes it: business criticality, data sensitivity, time to migrate, vendor readiness, migration feasibility, threat exposure, cryptography and compliance. You get a migration order you can act on, and the evidence to defend it.
Regulators have set the dates. The order of work is still yours to decide.
United States
NIST IR 8547 (draft) proposes deprecating quantum-vulnerable public-key algorithms after 2030 and disallowing them after 2035. Executive Order 14412 (June 2026) requires federal high-value and high-impact systems to use PQC key establishment by end-2030 and PQC signatures by end-2031.
European Union
The coordinated roadmap (June 2025) calls for national strategies and cryptographic inventories by end-2026, high-risk use cases transitioned by end-2030, and remaining systems by end-2035.
United Kingdom
NCSC timelines (March 2025): discovery and planning by 2028, high-priority migration by 2031, completion by 2035.
India
The National Quantum Mission Task Force roadmap (DST, February 2026) sets out two tracks: critical information infrastructure to secure high-priority systems by 2028 and reach full quantum resiliency by 2029; all other enterprises by 2030 and 2033. The Reserve Bank constituted an expert committee on a quantum-secure financial ecosystem in May 2026. SEBI's cyber-resilience framework already places cryptographic controls under supervisory obligation.
Standards say what to migrate to, and regulators say by when. QRAM tells you which of your systems to change first.
Every finding belongs to an asset you can act on.
Organised the way you run the business.
Company, business unit, system and asset. Scope an assessment at whichever level a decision is being made.
Covers the whole estate.
From servers, HSMs and firmware to databases, APIs, SaaS and network devices, each assessed on the factors that apply to it.
Cryptography attached to what it protects.
Every key, certificate and protocol is linked to its asset. Anything that cannot be matched is kept for you to link, never dropped.
Risk follows the data.
A system that hosts sensitive data takes on that data's exposure, so it cannot look safer than what it holds.
Vendors connected to their assets.
One confirmed vendor assessment updates the risk of the assets that vendor supplies.
Customer records database
Database · Owner: data platform team · Runs on: database server cluster
- TimelineHigh
- Data riskCritical
- Supply chainLow
- Migration feasibilityModerate
- Integrated viewHigh
- ThreatHigh
- CryptographyHigh
- ComplianceModerate
- Integrated viewHigh
Illustrative. Every rating opens to the asset's own inputs, artifacts and threat scenarios.
Seven modules, two roll-ups.
Foundation modules read what the asset is and what it holds. Advanced modules read the cryptography it actually runs. Each is weighted to your priorities, set once for an organisation, a business unit or a single project.
Foundation
Runs on asset data you already hold. No discovery tooling needed.
Integrated Foundation
Weighted average of the four, leaving out any that do not apply.
Advanced
Adds the cryptographic inventory you import.
Integrated Advanced
Weighted average of the three, on the same seven-band scale.
Every module reports on one seven-band scale, or NA where it does not apply to the asset.
One assessment, six teams that can act on it.
Board and executives
A funding case you can defend
A portfolio view on one seven-band scale, and a print-ready executive report that shows where risk sits and names the highest-risk assets and what drives each.
CISOs and risk leaders
An order of work, not a pile of findings
Assets ranked by integrated risk, with the module driving each. Pin a baseline run and compare every later run against it, asset by asset.
Architects and analysts
No more spreadsheet risk models
Import the CBOMs, discovery exports and asset lists you already have. Every key, certificate, protocol and library is classified against the knowledge base as it arrives.
Compliance and internal audit
Findings an auditor can test
Every artifact checked rule by rule against the baselines you assign, with the violating artifact and the rule shown for each finding.
Procurement and vendor management
Every vendor held to one standard
One post-quantum readiness questionnaire with must-pass questions. The confirmed result updates supply-chain risk for every asset that vendor provides.
Programme leads
Progress you can show
A readiness assessment with a recommended next step at every level, and dated snapshots to show how far the programme has moved.
From the data you hold to a ranked, explained result.
Set the scope
Create a project for a company, a business unit or a single system, and choose the modules to run.
Load your assets
Import a CSV, with a validate-only pass before anything is written, add assets in bulk, or start from the sample data set.
Load your cryptography
Import CycloneDX CBOM files, UCDI discovery exports or CSVs. Artifacts that match no asset are kept for you to link, and re-imports update rather than duplicate.
Review the threats
Each asset starts with the threat scenarios for its type. Adjust them per asset; QRAM asks before running on selections nobody has reviewed.
Assign policies
Choose the compliance baselines each project is checked against.
Run the assessment
Every enrolled asset is scored on the selected modules, and the run is pinned to the module settings and weights in force.
Act on the results
Drill from any score to its inputs and weights, compare with earlier runs, export to CSV and print reports.
Track readiness
Complete the readiness assessment, much of it answered from your project data, and assess your vendors.
Threat analysis grounded in NIST SP 800-30.
QRAM's Threat module is built on the risk model of NIST SP 800-30 Rev. 1, Guide for Conducting Risk Assessments: threat sources, threat events, vulnerabilities rated by severity, predisposing conditions rated by pervasiveness, and impact. The worst scenario sets each asset's result, so one severe exposure is never averaged away.
Your risk and audit teams recognise the method, and the content is built for the quantum threat: post-quantum scenarios for the data, control, management and platform planes of network and infrastructure devices, alongside general threat scenarios. Add your own entries next to the shipped ones.
Prepare
Project scope, modules in play, weights, and your own CRQC probability curve.
Conduct
Threat analysis and six further modules, for every enrolled asset.
Communicate
Executive and portfolio reports, and per-asset evidence down to each input.
Maintain
Re-run as the estate changes and compare against a pinned baseline.
What sets QRAM apart.
Start before discovery
Assess business context from the records you already hold, and point discovery at the assets that matter instead of scanning everything first.
Every score traceable
Open any rating to the inputs, weights and exclusions behind it. A reviewer who is not a cryptographer can follow the reasoning.
Your priorities, on the record
Tune what matters most for an organisation, a business unit or a single assessment. Every result records the priorities it was scored with.
Your quantum timeline
Plan against your own view of when a cryptographically relevant quantum computer arrives, and revisit it as estimates move.
Nothing critical averaged away
An asset takes the risk of its weakest artifact and its worst threat scenario. One exposed trust anchor is never diluted by healthy neighbours.
Gaps stated, not guessed
Missing inputs are left out and reported, and a dimension that does not apply is marked as such, never scored as zero risk.
Progress you can prove
Every assessment is kept as it was run. Pin a baseline and show the board, asset by asset, what has improved since.
Vendors feed risk automatically
A confirmed vendor readiness assessment updates supply-chain risk for every asset that vendor supplies, in one step.
Runs where your data must stay
On your own servers or on isolated hosts without internet access, with role-based access and a log of every change.
Built to be audited.
Runs you can reproduce
Each run records the configuration versions, weights and quantum-timeline assumption it used, sealed with a hash.
Results never overwritten
Every run keeps its own results. Label and pin a baseline, then compare any later run against it.
Your quantum timeline
Load your own probability curve for a cryptographically relevant quantum computer.
Every change on record
Who changed what and when, across the platform, with role-based and per-project access.
Start with what you know. Add cryptographic evidence where it counts.
QRAM Foundation
Timeline, Data Risk, Supply Chain and Migration Feasibility, from asset records and owner input your organisation already has.
The result: discovery effort and budget go to the systems that matter, instead of the whole estate at once.
QRAM Advanced
Adds Threat, Cryptography and Compliance on the cryptographic inventory you import, and combines them into one integrated view per asset.
The result: a migration order grounded in what each system actually runs, with the policy gaps named.
Measure your readiness to act, and your vendors.
Readiness gap assessment
A structured assessment of your post-quantum programme across six capability areas, from governance to execution. Every answer comes with the gap it implies and a recommended next action.
Much of it is answered automatically from your assessment data. Weight the areas that matter most, and keep dated snapshots to show how far the programme has moved.
Vendor PQC readiness
One structured questionnaire, sent to the vendor and scored consistently on return. Must-pass questions on cryptographic inventory, customer data handled, crypto-agility and a dated roadmap stop a weak vendor scoring well on everything else.
Once you confirm the scores, the readiness band updates the Supply Chain inputs of every asset linked to that vendor.
Two papers from AvinyaSQ on how quantum risk should be measured and governed.
Find out where your quantum risk sits.
Bring an asset list or a CBOM export. We will walk through what QRAM finds with your team.
Structured walkthrough on your own asset list. Nothing installed. No implementation commitment required.