You can't migrate the cryptography you can't see.

Eight discovery channels, one inventory

Real handshakes on the wire, passive analysis of PCAP files you supply, source-and-config code scanning, encrypted-file-at-rest analysis, certificate and key-list import, inventory sync from your CMDB, a PQC readiness probe that asks each TLS endpoint what it would negotiate, and endpoint sensors that report the connections no scan can route to — eight channels, one estate: network, certificate and CMDB discovery build the inventory, and code and file analysis catch what never crosses the wire — so nothing in the estate stays dark.

OT, IoT, and mainframe in reach

Dedicated probes cover Modbus, DNP3, S7comm, EtherNet/IP, BACnet, OPC UA, MQTT and CoAP — plus IP-camera RTSP/ONVIF and mainframe TN3270E and IBM MQ — the 10-to-20-year-lifecycle assets generic scanners miss. A 70-family algorithm knowledge base — every rating operator-tunable, though the list itself is fixed: an in-house or national algorithm outside the shipped 70 cannot be added — behind 114 probes per host maps every finding to a named migration recommendation, not a bare "unknown."

Quantum and classical, one score

Every observation is scored on two independent axes — Shor-era quantum status and classical hygiene — then collapsed to a single 0–100 risk score and a five-level severity band. Key-size escalation means a 1024-bit RSA key is reported broken, not laundered into "ok" by a family default.

HNDL grounded in Mosca's inequality

Harvest-now-decrypt-later exposure is computed per asset from data retention versus a calendar-anchored quantum horizon, so migration deadlines actually come due instead of forever receding. Un-curated assets surface as a data-quality gap, never a false clean bill of health.

Exposure priced in your currency

A transparent model whose impact anchors you set turns technical risk into money, so leadership prioritizes in dollars, or dinar. Figures display in any of 10 currencies, 8 of them MENA — no outbound call required.

Every mandate, one readiness number

Your reported roadmap progress is scored against 21 frameworks and 78 individually scored controls — CNSA 2.0, NIST IR 8547, FIPS 140-3 / CMVP module transition (tracking), PCI DSS 4.0, PCI PTS HSM, DORA, the EU CRA, UK NCSC, BSI, ANSSI, CCCS, ASD, ISO/IEC 18033-2 and IETF TLS, plus the MENA regulators (SAMA, CBJ, CBK, the UAE — and Saudi NCA’s general cryptographic-hygiene controls) scored natively rather than force-fit into a US framework — into one number, with per-control met / partial / gap evidence. For FIPS 140-3 specifically, PQCA tracks your plan to move onto CMVP-certified modules. It does not validate modules, and it is not a substitute for CMVP.

Deployment-aware verdicts

Because ANSSI, BSI, ASD, and CNSA 2.0 disagree on hybrid versus pure PQC, PQCA judges every negotiated key exchange against each of the four that applies to you — so "we deployed ML-KEM" gets the right answer for each jurisdiction, not a hopeful one.

Policy-as-code, no policy engine

Start with a sentence — banned and approved families with minimum key sizes like RSA<3072 — and graduate to a portable, schema-validated JSON policy with a tiered ladder and first-match-wins rules. Violations are detected against the live estate with no false positives on unknown key sizes, and sunset dates tighten the policy automatically as deadlines pass.

Five phases, standards-aligned

A fixed, ordered roadmap aligned to the CBJ sectoral roadmap and NIST migration guidance, with admin-editable timeline windows. A fresh install seeds an 18-item kickoff checklist, so you begin with a plan, not a blank page.

Discovery to backlog in one click

Generate-from-inventory turns every quantum-vulnerable asset, certificate, and application into an owned, dated, priority-ranked task — deduplicated and linked to the exact item it migrates. The same estate the platform scanned becomes the plan the team works.

QRC-Budget, rolled up by phase

Every action item tracks cost, paid, and computed remaining, aggregated per phase and across the whole program in your display currency. A CISO sees committed-versus-paid-versus-still-needed at a glance, with server-side guards that keep the figures internally consistent.

Readiness that tracks real work

Compliance readiness is computed from the roadmap itself — each control is bound to a phase and scored by that phase's real completion, not by whether a scan happened. Applying a framework seeds its unmet obligations into the backlog at 0%, so nothing you haven't done can score as done.

Built for enterprise scale

PQCA is production software for large, regulated environments — not a pilot tool or a consultant's script. It runs across segmented networks, data centers and OT plants; Active Directory groups map to administrator and read-only access. PQCA ships four user roles in total — Administrator, Checker, Maker and Read Only: Maker and Checker provide a maker-checker (four-eyes) control over governed changes and are assigned in the platform after directory import, and unattended integrations use separate service-account keys with least-privilege roles — importer, sensor and federation — each confined to a single endpoint. Every scan, score, export and decision is written to an audit trail the application only ever appends to, with the acting user, the timestamp and the before-and-after state; it is not hash-chained, and a full platform restore replaces it, so forward it to your SIEM if you need tamper-evidence held outside the platform. Deploy per region or per subsidiary, each instance sovereign to its own jurisdiction and data-residency rules — on hardware you already own, integrated with the directory and SIEM you already run.

One internet destination, and only if you want it

PQCA’s only vendor-chosen outbound call is an optional exchange-rate refresh — triggered by an admin, never on a timer, and skippable entirely by typing rates by hand. Ten offline fallback rates ship, so currency conversion works with the cable out.

Every other connection PQCA makes goes only to a host you configure on your own network, and none is contacted until you enable it: ticketing and chat (ServiceNow, Jira, Slack or a generic webhook), scheduled inventory pulls from your CMDB, Master-to-subsidiary federation reads, your SMTP relay, your SIEM over syslog/CEF, and your Active Directory. Once enabled, several of those run on a schedule without an operator present.

The web console itself loads nothing from the internet — no CDN, no fonts, no analytics. One codebase installs four ways — Docker, an offline Docker bundle, native Windows, or native Ubuntu — and three of the four run on networks with no internet at all.

One group, every entity

A Master PQCA links each subsidiary, reads its posture on a schedule and reports the group side by side — group exposure, mean readiness, the weakest entity and the soonest mandate — while every subsidiary’s data stays in its own install. Built for banking groups and regional holdings with several licensed entities: a subsidiary is read live from its own PQCA, or from a CBOM it uploads. Licensed per number of linked subsidiaries. This is federation — many separate installs reporting upward to a parent — not multi-tenant isolation inside one install.