Think Earlier.
A number you can defend twelve months from now, not a claim you have to walk back.
The Q-Risk Score is a 0–100 quantum risk metric scored across five weighted pillars, constrained by hard ceilings that prevent inflated posture claims. The methodology is published, auditable, and aligned to QCI-QS1.
Think earlier. Act when the evidence says to act.
Raw score = 4 × P1 + 4 × P2 + 4 × P3 + 5 × P4 + 3 × P5 Final score = min(raw score, every triggered gate cap) Each pillar level is an evidenced integer from 0 to 5. G60, G70 and G80 cap the result at 60, 70 and 80 when failed.
The Core formula uses the five evidenced pillar levels. The final result cannot exceed any failed gate's cap. A not-applicable pillar does not receive redistributed weight or a 0–100 total.
Ownership, risk decisions, obligations, oversight and reporting.
Validated inventory of critical systems, critical data flows and cryptographic dependencies.
Confidentiality and verification horizons, long-lived data and exposure through critical flows.
Migration decisions, accepted protection and tested algorithm replacement.
Current product-specific supplier roadmaps, authorized attestations and oversight.
The v2.3 gates cap a formal score when their pass conditions are not evidenced. The free 26-question screening does not verify or apply these gates.
Both critical-system and critical-flow validated coverage must reach at least 95 percent, without an unresolved material population discrepancy.
Every critical supplier needs a current, adequate product/deployment-specific roadmap response and authorized attestation. An operating exception is not a substitute.
At least one critical trust pathway must pass an end-to-end crypto-agility test within the previous 12 months and after an invalidating material change.
These are categories for comparable, independently assessed records—not live published benchmarks. Peer comparisons require the same edition, Core profile and metric definitions (QCI-6.3-02). No aggregate results are shown here.
Score bands and median scores by sector.
P1 governance (20), P2 visibility (20), P3 exposure management (20), P4 migration and agility (25), P5 third party (15).
Time to close high-severity findings.
Share passing G60, G70 and G80, by sector.
Under QCI-QS1 v2.3, each pillar receives an evidenced integer level from 0 to 5. Raw score = 4×Governance + 4×Crypto visibility + 4×Data longevity + 5×Migration readiness + 3×Third-party readiness. Failed G60, G70 and G80 gates cap the final score at 60, 70 and 80 respectively.
G60 caps the score at 60 without at least 95 percent validated coverage of both critical systems and critical data flows. G70 caps it at 70 without adequate current roadmap responses and authorized attestations from every critical supplier; an exception does not substitute. G80 caps it at 80 without a current end-to-end crypto-agility test on a critical trust pathway.
Yes. The methodology is published as part of the QCI-QS1 v2.3 standard (Clause 6) and is freely available. An assessment requires evidence and an identified scope, period and assessor.
Clause 6 defines the five pillars and their evidenced levels. Governance is P1, crypto visibility and QASI P2, data longevity and exposure P3, PQC migration and crypto agility P4, and third-party readiness P5. The free questionnaire is only a self-reported screening estimate, not a Clause 6 score.
The free 26-question tool provides a self-reported screening estimate and priority areas. An evidenced QCI-QS1 v2.3 score requires pillar decisions and gate review.