QRA™ | Quantum Readiness Auditor

The problem

Organisations are encrypting sensitive data today using public-key cryptography that a sufficiently capable quantum computer is expected to be able to break. This is often called "Harvest Now, Decrypt Later" — adversaries capture encrypted data now, and decrypt it once quantum computing makes that practical. Data with a long confidentiality lifetime — health records, legal documents, trade secrets, government communications — is most exposed to this risk.

The principal migration concern involves quantum-vulnerable public-key cryptography, such as RSA and ECC, rather than all encryption uniformly. Symmetric cryptography such as AES has different quantum-security considerations and is not affected in the same way.

Before any organisation can plan a post-quantum migration, it first needs visibility: which applications and endpoints actually rely on cryptography that will need to change, and which don't. That visibility is largely missing today. QRA is being built to provide it.

What QRA does

Local cryptographic asset discovery

Algorithm and artefact recognition

Risk and confidence classification

Quantum-migration context

Evidence ledger

Markdown, JSON, HTML, PDF and XLSX reporting

Optional Windows-oriented network discovery (under validation)

      Finding an algorithm or cryptographic artefact does not prove that it is active, exploitable, incorrectly deployed or responsible for a vulnerability. Human validation is required.
    

      Local assessments analyse accessible artefacts and generate reports locally. QRA does not upload assessment findings as telemetry in the inspected local workflow. Initial activation, periodic subscription validation and optional authorised network discovery require network connectivity. QRA is designed not to rewrite assessed assets, but it creates its own reports, cache, evidence ledger and commercial licence state.
    

Quantum readiness categories

QRA classifies discovered cryptography into distinct readiness categories, rather than a single pass/fail result:

Broken

Classically broken

Cryptography already considered broken by conventional (non-quantum) attacks — e.g. MD5, SHA-1, DES.

Harvest risk

Harvest Now, Decrypt Later

Currently secure classically, but vulnerable to future quantum decryption — the core post-quantum migration concern.

Vulnerable

Quantum-vulnerable

Public-key cryptography with known theoretical quantum attacks, such as Shor's algorithm against RSA and ECC.

Transition

Transition algorithms

Algorithms used as interim steps on the path toward full post-quantum readiness.

Post-quantum reference

Post-quantum / quantum-resilient

Standardised post-quantum algorithm families designed to resist currently known classical and quantum attacks when implemented and deployed correctly — including ML-KEM, ML-DSA, and SLH-DSA. "Compliant" is an internal QRA assessment label only; it is not a certification, regulatory conclusion, or guarantee that a deployment is quantum-safe.

Detection registry

QRA's current detection registry includes, among others:

1 Classically broken & legacy

MD5
SHA-1
DES / 3DES / RC4

2 Quantum-vulnerable public-key

RSA 1024 / 2048 / 3072 / 4096
ECDSA, ECDH
DSA, Diffie-Hellman
Ed25519 / Ed448

3 Currently secure (classical)

AES-128 / 192 / 256-GCM
SHA-256 / SHA-512 / SHA-3

4 Post-quantum / quantum-resilient

ML-KEM
ML-DSA
SLH-DSA

How it works

Endpoint / Application

QRA is pointed at a target environment — a local endpoint, directory, or application footprint.

QRA Discovery

Local, offline discovery identifies cryptographic assets — keys, certificates, algorithm usage — without modifying the target.

Crypto Classification

Each discovered asset is classified against the quantum readiness categories above.

Evidence Ledger

Findings are recorded with supporting evidence, preserving a defensible record of what was found and where.

Quantum Readiness Report

A structured report summarises exposure by category, supporting migration planning and prioritisation.

Current status

      Technical Preview — QRA v1.3.5-RC1. QRA v1.3.5-RC1 is not yet production-ready, enterprise-ready or approved for unrestricted MSP deployment.
    

QRA has completed substantial internal development and automated testing, including local/offline cryptographic asset discovery, an approach designed not to rewrite assessed assets, cryptographic algorithm identification, quantum-vulnerability classification, an evidence ledger, and reporting. The current QRA v1.3.5-RC1 automated test result is 84 passed and 2 intentionally skipped in the development environment. This does not mean the executable is commercially release-ready.

Remaining release validation includes packaged Windows-crawl dependencies, WinRM certificate validation, native liboqs testing, packaged valid-licence end-to-end testing, clean-machine validation, sensitive licence-data review and executable signing.

External testing programme

The purpose of this programme is to obtain independent testing, identify false positives and false negatives, validate compatibility across Windows environments, validate reporting and usability, and gather evidence before broader MSP deployment.

We are seeking

MSP technical teams
Cybersecurity practitioners
IT administrators
Cryptography / security researchers
Technically capable Windows testers

Testing areas

Detection accuracy
False positives & false negatives
Windows compatibility
Report quality
Performance
Usability
Network-discovery behaviour

Safety & testing notice

      Technical Preview builds should initially be used only on test systems, lab environments, spare endpoints, or environments where the tester has explicit authorisation. Do not run Technical Preview software against production systems without authorisation.
    

Apply to join the QRA Technical Preview

We're looking for technically capable testers to help validate QRA across real Windows environments before broader release.

Apply to Test QRA

QRA™ — Quantum Readiness Auditor