Skip to content
TRINEDRATalk to an Expert
Home/Quantum Risk Assessment

Quantum Risk Assessment

Quantum Risk
Assessment.

Knowing where you stand before quantum computers can read what you've encrypted.

Talk to an Expert Explore quantum interactively

Locate. Quantify. Fortify.

QUANTUM / A DIFFERENT PERSPECTIVE
EXPLORE THE CONNECTIONSuperposition

Move your pointer to shift perspective · choose a view

Quantum concepts to exploreInteractive learning experiences
Cryptographic discovery viewsSix discovery views beyond a conventional asset list
Prioritised migration roadmapShaped around your exposure

An interactive perspective

Step into the unfamiliar.
Make the ideas visible.

Transform the field between three quantum concepts, then explore the working experiments below. Move your pointer or use the viewing-angle control.

The quantum observatory
Conceptual illustration
SuperpositionPREPARE → CORRELATE → INTERFERE

A state of possibilities.

The field changes shape to introduce superposition. The experiment below lets you prepare a qubit and inspect its measurement probabilities.

WHAT TO CONSIDER

These particles are an artistic visualisation. Use the experiment below for the mathematical model.

Try the superposition experiment

Quantum Risk Assessment

Why This Service Exists

Quantum Risk Assessment is an innovative service built to answer one question in specific, evidence-based terms: where, exactly, is your organization exposed once that day arrives — and what should you fix first?

Almost everything online today — passwords, banking, medical records, private communications and many other digital services — depends on cryptography. Widely used public-key systems rely on mathematical problems that ordinary computers cannot solve efficiently at useful security sizes. A quantum computer that is sufficiently large and reliable could solve some of those problems efficiently, undermining the protection those systems provide.

This service connects that changing threat to specific evidence about your organisation: the cryptography in use, the importance of the systems and data it protects, and the actions to prioritise.

Understand the quantum threat

How a Quantum Computer
Changes Today’s Encryption

You don’t need a physics background to explore the threat. Superposition, entanglement and interference are key concepts behind quantum computation. Prepare a state, measure a pair and change a phase in these idealised browser simulations.

Enable JavaScript to use the simulations. The explanations below remain available.

SUPERPOSITION

Superposition
A state of possibilities.

A classical bit is 0 or 1. A qubit can be prepared in a superposition with an amplitude for each outcome. Multiple qubits can represent amplitudes across many possible bit strings. Measurement in a chosen basis returns one result, with probabilities determined by the squared amplitudes; it does not let us read all candidate answers at once.

TRY THIS

Prepare an equal superposition, then measure it. The state collapses to the result. Measure again before preparing a new state and the result stays the same.

WHAT TO NOTICE

The sphere represents a quantum state, not a particle travelling between 0 and 1. One measurement does not reveal every possibility at once.

Prepare → measure → prepare againIdeal qubit model
A qubit state on a Bloch-sphere meridianAn equal superposition has 50% probability of 0 and 50% probability of 1 when measured in the Z basis.|0⟩|1⟩
CURRENT STATE(|0⟩ + |1⟩) / √2

Z-basis measurement
Relative phase fixed at 0

50%
Pure |0⟩Equal amplitudesPure |1⟩
Outcome 050%
Outcome 150%

Prepare a state, then measure the qubit.

See the model

|ψ⟩ = √(1 − p)|0⟩ + √p|1⟩, where p is the selected probability of 1. This is a pure state with a fixed relative phase. The sphere shows one meridian of the full state space. Sampling uses browser randomness.

ENTANGLEMENT

Entanglement
One shared system.

Some joint quantum states cannot be separated into an independent state for each qubit. In the Bell pair shown here, measurements in matching Z or X bases have matching outcomes, even though each local result is random.

TRY THIS

Measure several fresh pairs with matching bases. Then change one side from Z to X. Compare the possible joint outcomes and their probabilities.

WHAT TO NOTICE

Entanglement cannot send a controllable message faster than light. The correlations become useful when results are compared. Correlation in one basis alone is not proof of entanglement.

Explore a Bell pairIdeal joint state
Two qubits in the Bell state Phi plusEach local result is random. Matching Z or X bases produce matching outcomes.??QUBIT A · ZQUBIT B · Z|Φ⁺⟩ = (|00⟩ + |11⟩) / √2Each local outcome remains 50/50
THEORETICAL JOINT OUTCOME PROBABILITIES · A / B
50%
0 / 0
0%
0 / 1
0%
1 / 0
50%
1 / 1

Choose the measurement bases and measure a fresh pair.

No pairs measured yet.

See the model

The ideal |Φ⁺⟩ Bell state produces 00 or 11 with equal probability in matching Z bases, and ++ or −− with equal probability in matching X bases. With Z on one side and X on the other, all four combinations are equally likely. This simulation illustrates the predictions; it is not an experimental Bell test.

INTERFERENCE

Interference
Reinforce or cancel.

Quantum amplitudes have phase. When paths combine, their amplitudes can reinforce or cancel. Quantum algorithms arrange these operations so some outcomes become more likely and others less likely.

TRY THIS

Move the phase from 0° to 180°. Watch the contribution to output 0 cancel, while output 1 becomes certain. At 90°, both outcomes are equally likely.

WHAT TO NOTICE

Cancellation does not destroy probability. It changes where the probability goes. The wave drawing illustrates amplitudes; it is not a picture of a particle’s physical motion.

Turn the phase. Change the outcome.Ideal circuit model
|0⟩H0°HMeasure
Two amplitude contributions and their combination at output zeroAt zero degrees relative phase, output zero has probability 100%.PATH APATH B · RELATIVE PHASECOMBINED CONTRIBUTION TO OUTPUT 0

Reinforcement at output 0 · 100% probability.

0°
0° · aligned180° · opposite360° · aligned
Output 0 probability100%
Output 1 probability0%

See the model

Starting in |0⟩, the H → phase(φ) → H circuit gives P(0) = cos²(φ/2) and P(1) = sin²(φ/2). The wave picture shows two unit contributions and their normalised sum for output 0. The total probability is always 1.

Explore the foundations: IBM’s introduction to quantum computing. The controls above are simplified mathematical models for learning, not a demonstration of an attack on encryption.

Put Together: The Cryptographic Consequences

How Quantum Algorithms
Change Cryptographic Security

Quantum computing combines superposition, entanglement, and interference to solve certain complex problems far more efficiently than classical computers. With a sufficiently powerful, fault-tolerant quantum computer, algorithms such as Shor’s algorithm could break widely used public-key cryptography such as RSA and ECC—a task considered impractical for current classical computers.

This emerging threat is driving the adoption of post-quantum cryptography (PQC), designed to protect digital systems against future quantum attacks.

Shor’s Algorithm · RSA & Elliptic Curves

On a sufficiently capable quantum computer, Shor’s algorithm can efficiently solve integer factorisation and discrete logarithm problems. Factorisation underpins RSA; elliptic-curve cryptography relies on elliptic-curve discrete logarithms. These are different mathematical problems, both vulnerable to this family of quantum techniques. The exposure reaches public-key uses in internet connections, VPNs and digital signatures.

Grover’s Algorithm · Symmetric Key Search

Grover’s algorithm offers a quadratic reduction in the number of idealised search steps: roughly √N rather than N for an unstructured search of N possibilities. For ideal key search this suggests a halving of the security exponent. Practical attack cost also depends on sequential execution, hardware limitations and the key size. Assessing symmetric ciphers such as AES therefore requires a different analysis from the public-key exposure associated with Shor’s algorithm.

Technical references: Shor’s paper on factoring and discrete logarithms · NIST’s explanation of Grover’s algorithm and symmetric cryptography.

Prepare for long-term exposure

Why the Clock
Is Already Running

A capable quantum computer does not need to exist today for organisations to consider long-term exposure. An adversary can retain encrypted traffic now and attempt to decrypt it when the necessary capability becomes available.

Confidentiality can outlast today’s protection.

Contracts, health records, government files, long-lived credentials and other sensitive information may need to stay confidential for years. Assess the lifetime of the information alongside the time and effort needed to migrate its cryptographic protection.

There is no reliable date for a quantum computer capable of breaking these deployed systems. The assessment helps organisations prepare around exposure and business priority.

NIST: harvest now, decrypt later ↗

Standards have moved into implementation.

NIST released its first three final post-quantum standards in August 2024: FIPS 203 for ML-KEM, FIPS 204 for ML-DSA and FIPS 205 for SLH-DSA.

Migration plans need to account for applicable sector, regulator and customer requirements. Required timelines depend on the organisation and its obligations.

Read NIST’s standards announcement ↗

Our Methodology: The Quantum Exposure Method

Locate. Quantify.
Fortify.

Rather than a one-time scan or a generic checklist, we assess quantum risk through a purpose-built, three-stage method: Locate every place cryptography is used, Quantify how exposed each use actually is, and Fortify the ones that matter most, first.

STAGE 01

Locate

Nothing can be protected until it's found, and most organizations have no reliable answer to “where is our encryption?” We build that answer by examining the environment from every angle where cryptography tends to hide:

  • Live network traffic - connections, protocols, and certificates actually in use.
  • Applications and source code - including keys or algorithms built directly into software.
  • Servers and operating systems - configuration, stored keys, and outdated settings.
  • Files, documents, and repositories - certificates and cryptographic material sitting in storage.
  • Key management platforms - how keys are created, rotated, and retired.
  • Dedicated security hardware - the physical modules built to safeguard keys.

The output is a single, accurate inventory of every algorithm, certificate, and key across the organization — the foundation the rest of the assessment is built on.

STAGE 02

Quantify

An inventory alone doesn't tell you what to fix first. Every item we find is evaluated on two dimensions: how important the system or data it protects is to the business, and how exploitable the cryptography protecting it actually is against a quantum-capable attacker - accounting for the specific algorithm, key length, and how well the keys behind it are managed.

Combining the two produces a clear order of priority, starting with the highest-value data sitting behind the weakest quantum protection. We also weigh in how much your current safeguards already reduce that exposure, so the final risk picture reflects your actual defenses, not just a theoretical worst case. What leadership receives is a ranked list they can act on immediately, expressed in plain business terms rather than cryptographic jargon.

STAGE 03

Fortify

A risk ranking only matters if it leads to action. We turn it into a practical, sequenced migration plan, starting with the highest-priority systems.

Where appropriate, evaluate blended or hybrid protection that combines an established cryptographic method with a post-quantum method. The design, integration and compatibility of those methods need validation; combining them is not a guarantee against every weakness.

Deliver progress in stages with clear checkpoints so risk reduction becomes visible early. Revisit the plan as systems, safeguards and the threat change, rather than relying on a single all-at-once cutover.

The TRINEDRA approach

What Makes This
Approach Different

Connect discovery, numerical assessment, recognised standards and a migration approach that can be revisited as your environment changes.

Numerical, evidence-based priorities

Every finding is expressed as a number, not a subjective red, amber, or green guess - so priorities are defensible in front of a board or an auditor.

Six discovery angles

Cryptography is surfaced from six different angles at once, catching what a typical asset list or CMDB routinely misses.

Standards-linked recommendations

Every recommendation ties back to recognized standards, so the resulting report doubles as audit-ready evidence.

A risk view that can be revisited

The assessment isn't a one-time PDF - it's designed to be revisited and re-scored as your systems and the quantum threat itself evolve.

Phased, blended migration

Evaluate hybrid cryptography and staged implementation to gain quantum resistance while managing compatibility and disruption. The roadmap is sequenced around risk and business priority.

Built around your priorities

Who This Service
Is For

Finance, healthcare, government, defence and infrastructure organisations — and the teams accountable for their security, platforms and migration plans.

Long-lived sensitive data

Organizations in finance, healthcare, government, defense, or infrastructure that hold sensitive data with a long shelf life.

A defensible migration case

Teams preparing a migration budget or roadmap that will need to be defended to a board or a regulator.

An evidence-based readiness answer

Security and platform teams who need an evidence-based answer to “are we quantum-ready?” rather than an opinion.

Assessment deliverables

What You Receive
Evidence. Priorities. A roadmap.

Six outputs connect technical discovery to financial, operational and reputational consequences, migration priorities and executive review.

Cryptographic inventory and dependency map

A complete map of cryptographic systems, algorithms and keys across the agreed assessment environment.

Ranked exposure and risk view

A ranked risk view showing exactly which assets are most exposed, and why.

Business impact analysis

A plain-language breakdown of the potential financial, operational, and reputational impact behind each risk.

Phased migration roadmap

A phased migration roadmap sequenced by risk and business priority.

Executive assessment summary

An executive summary written for board and regulator review, not a technical audience.

Optional ongoing monitoring

An optional ongoing monitoring option that keeps the picture current as your systems and the threat landscape change.

Interactive cryptographic risk example

Map the dependency.
Prioritise the response.

Explore an illustrative cryptographic risk register. Adjust the treatment plan to see how example exposure scores and priorities change. This is not a forecast of quantum capability or an assessment of your systems.

Cryptographic exposure intelligence
Interactive example
Example risks6illustrative register
High + critical5current scenario
Modelled score reduction—planned treatment

Risk exposure map

IMPACT →

QUANTUM EXPOSURE →

Low 1–5Moderate 6–11High 12–19Critical 20–25

Select a cell to inspect its risks. The circle shows the risk count; the small number is the cell score. Select again to cycle through a shared cell.

Enable JavaScript to explore this illustrative dashboard. Service information and assessment links remain available below.

EXAMPLE RISK—

Select a risk to explore

Explore how a proposed control plan changes an illustrative risk score.

Proposed treatment

Treatment details appear here.

60%
0% · no change100% · full example plan
Selected risk · current—
Selected risk · planned—
Example risk register · select a row
Aggregate risk score9-month treatment scenario
Current and planned aggregate risk scoresAn illustrative treatment scenario over nine months. Enable JavaScript to update the chart.——0NowMonth 3Month 6Month 9
Dashed: current total. Mint: planned total. The chart sums the example scores; it does not estimate financial loss.

Illustrative data, not a live assessment or product screenshot.

How this example is calculated

Example priority score = quantum exposure × business impact, each rated 1–5. Treatment coverage reduces each example’s exposure by a preset 1–3 points at full coverage, rounded to the nearest whole point, with a minimum of 1. Impact stays fixed. The plan is applied in equal thirds at months 3, 6 and 9. This is an illustrative migration-priority model, not a prediction of quantum capability, a cryptographic security estimate or a delivery timeline. Actual assessments require evidence and agreed scoring criteria.

Your next step

Find out where you’re
quantum-exposed.

A short discovery call is the fastest way to see what a full Quantum Risk Assessment would surface in your environment.

Book a Quantum Risk Discovery Call

Tell us about your organisation and assessment needs. Together, we can define the right scope.

Talk to an Expert Contact TRINEDRA
Explore all TRINEDRA services