Measuring and reporting post-quantum readiness
What to measure so leadership can see progress, and how to report it without drowning in jargon — a small set of honest readiness metrics and a reporting cadence that survives contact with a busy board.
Measure coverage, exposure, and agility
Three things tell you where you stand: how much of your cryptographic estate you have actually discovered (coverage), how much of it is high-risk and still vulnerable (exposure), and how much can swap algorithms without a rewrite (agility). Report a small number of trending metrics, not a data dump — a metric that does not move a decision does not belong in the deck.
You cannot manage what you cannot measure, and you cannot report what you cannot explain in one line. The goal of readiness metrics is not precision theater — it is to answer three executive questions: do we know where our crypto is, how much of the risky part is fixed, and are we getting faster or slower.
The metrics that matter
- **Inventory coverage** — the share of systems, endpoints, and repositories that have been scanned for cryptography. Everything else is meaningless until this trends toward complete.
- **Vulnerable-asset count** — how many discovered assets still use quantum-vulnerable algorithms (RSA, ECDH, ECDSA), split by exposure so the risky ones stand out.
- **High-priority exposure** — vulnerable assets protecting long-lived or externally-facing data (the harvest-now-decrypt-later set). This is the number that should fall fastest.
- **Crypto-agility ratio** — the share of systems that can change algorithm through configuration rather than a code change. This predicts how painful the next migration will be.
- **Hybrid / PQC adoption** — externally-facing services already using post-quantum or hybrid key exchange.
- **Vendor readiness** — the share of critical third parties with a documented PQC roadmap.
Report trends, not snapshots
A single point-in-time number invites arguing about the number. A trendline — coverage climbing, high-priority exposure falling — tells a story an auditor and a board can both follow. Keep the same metric definitions across reporting periods so the trend is real and not an artifact of a changed denominator.
A readiness score, used carefully
A single composite readiness score is useful for a headline, but only if it is honest about what it rolls up. Quantakrypto's tooling produces a readiness score from discovered assets weighted by exposure; treat that score as a communication device sitting on top of the underlying metrics, not a substitute for them. Always be able to drill from the score into coverage, exposure, and agility, or it becomes a vanity number.
A reporting cadence that survives a busy board
- **Working group — biweekly.** Operational: what got scanned, what got migrated, what is blocked.
- **Executive sponsor — monthly.** One page: coverage and high-priority exposure trends, blockers needing escalation, next milestone.
- **Board / risk committee — quarterly.** The headline readiness trend, the residual risk in plain language, and the ask for the next period.
Do not report activity as if it were progress
'We held twelve meetings and scanned forty repos' is activity. 'High-priority exposure fell from 340 assets to 180' is progress. Leadership funds outcomes. Tie every reported metric back to reduced risk, not effort expended.