News
The two-week readiness sprint, explained
Fixed fee, two weeks, and three things you can take to the board: an exposure heatmap, a Mosca analysis and ten priorities.
QCT Studio team1 min read
Fixed fee, two weeks, and three things you can take to the board: an exposure heatmap, a Mosca analysis and ten priorities.
Why this matters now
Regulators have moved from asking whether firms are aware of the risk to asking what they have done about it. That shift changes the conversation from research to delivery, and delivery needs an inventory, an owner and a date.
- Inventory first. You cannot migrate what you have not found.
- Rank by shelf life. Data that must stay secret longest moves first.
- Prove it continuously. A one-off report goes stale the day after it is filed.
The question is not whether the risk is real, but whether your migration finishes first.
What good looks like
| Stage | Output | Owner |
|---|---|---|
| Assess | Exposure by data class | CISO |
| Discover | Cryptographic inventory | Platform teams |
| Migrate | Hybrid designs in pilots | Architecture |
| Assure | Drift watch, board reports | Risk |
A note on hybrids
Hybrid schemes pair a classical algorithm with a post-quantum one, so the result is at least as strong as the stronger of the two:
shared_secret = KDF(x25519_secret || ml_kem_768_secret)
This is sample content generated by pnpm mockdata:up to show the layout. Remove it with pnpm mockdata:down.
- readiness sprint
