Understand quantum risk in your cryptographic estate.

Quantum Penetration Test

$25,000

fixed · 60 days · One engagement · full estate

• Cryptographic asset inventory across infrastructure, applications, and data stores
• Shor / Grover proof-of-concept attack circuits run against representative key material on simulators
• Harvest-now-decrypt-later exposure scoring per asset, weighted by data lifetime
• Prioritized PQC migration roadmap mapped to NIST ML-KEM / ML-DSA / SLH-DSA standards
• Executive briefing + engineer-level technical report with reproducible circuit evidence

Ongoing Advisory

Scoped

after assessment · After the initial assessment

• Quarterly re-test of the cryptographic inventory as your stack changes
• Standing threat-model updates as quantum hardware and algorithms advance
• PQC migration support: review of proposed designs and vendor claims
• Priority access to live-hardware validation runs as provider authorizations land
• Audit-ready quarterly readiness letter for customers and compliance

Cryptographic discovery

Weeks 1–2

Review agreed offline materials and architecture documentation. Identify cryptographic dependencies, algorithms, key sizes, and the lifetime of the data they protect.

Controlled modeling

Weeks 3–6

Small Shor and Grover circuit demonstrations explain attack mechanisms. Relate in-scope algorithms to published quantum-resource estimates, with measured demonstrations and forward-looking extrapolations labeled separately.

Report and roadmap

Weeks 7–8

Prioritize findings and migration steps, with an executive briefing and an engineer-level technical report. Document assumptions, open questions, and limitations.

Finance and custodians

Review long-lived records, signing dependencies, and cryptographic assets included in your scope.

Healthcare and insurers

Put confidentiality lifetimes and system dependencies into a practical migration discussion.

Enterprise and infrastructure teams

Give architecture, procurement, and security leaders a common inventory and documented priorities.

Do you run attacks on real quantum hardware?

Simulators are the default. Live QPU execution through Azure Quantum or AWS Braket is reserved for agreed validation milestones and requires a signed engagement addendum and the provider’s written authorization.

Is this just a readiness checklist?

The assessment combines agreed cryptographic materials, controlled small-scale circuit demonstrations, published resource estimates, and data-lifetime context. It does not claim to break production keys; demonstrations and forward-looking extrapolations are reported separately.

Should we finish our classical security program first?

Cryptographic inventory can support both classical security work and migration planning. A scoping call helps decide whether this assessment is a useful next step for your organization.

What do we need to provide?

A technical point of contact, agreed architecture documentation or offline materials for review, and a signed engagement agreement. No production credentials are required. Representative key material is generated, never extracted.

What about regulatory requirements?

Applicability depends on your sector, contracts, and current requirements. This report supports planning; it is not a certification, legal determination, or guarantee of compliance.

Can free tools provide an inventory?

Tools can help build a cryptographic bill of materials. Our engagement brings agreed materials, exposure modeling, evidence, and migration priorities into one report. It does not add live scanning to the offered scope.

Does this replace a conventional penetration test?

This is a quantum-cryptographic assessment. It excludes active exploitation, web-application attacks, credential attacks, social engineering, and denial of service. Classical security testing is a separate engagement with its own authorization.