Skip to main content
View as MarkdownOpen in ChatGPTOpen in Claude

PQC Readiness

Your cryptographic estate's post-quantum posture in one view: how many assets are in scope, who owns them, how they measure against your crypto compliance policy, and which ones to address first.

The PQC Readiness view composed on a live tenant — estimated assets in scope, ownership and orphan assets, compliance status, quantum-vulnerable assets, the Algorithm Posture Matrix, fixable-now issues, and the top 10 assets to address

Estimated assets in scope​

How big is the problem?

The total count of software and cryptographic assets Mesh has discovered in your environment, split by kind. Selecting a count opens the asset list, pre-filtered to that kind.

Ownership & Orphan Assets​

Who is responsible for what — and what has no owner at all?

A quadrant of owner-assigned vs. no-owner against linked vs. not-linked assets. The bottom-right cell — no owner, no link — is your orphan population: assets nobody would think to migrate. Selecting a cell opens the asset list with those filters applied.

Compliance Status​

How much of the estate meets the active crypto policy?

Compliant, non-compliant, and unknown shares of your assets, judged against the organization's in-force crypto compliance policy.

Quantum-vulnerable assets​

How much of the estate is exposed to quantum attack?

The share of assets using quantum-vulnerable cryptography, with unknowns reported honestly rather than counted as safe.

Algorithm Posture Matrix​

Of everything we discovered, how much uses algorithms our policy considers good, aging, or unacceptable?

Every discovered asset is graded against your organization's active crypto compliance policy into five tiles — Preferred, Acceptable, Deprecated, Disallowed, and Unclassified (observed, but not yet graded by your policy). The grading is read from your policy, not a fixed industry list, and key size is part of the grade: a policy with a 3072-bit floor grades RSA-2048 as Disallowed and RSA-4096 as Acceptable.

The Algorithm Posture Matrix widget showing live counts of assets graded into Preferred, Acceptable, Deprecated, Disallowed, and Unclassified tiles

Select a tile to open a drill-down that lists which algorithms make up the category, how many assets use each one, and a sample of those assets:

The Disallowed drill-down listing the algorithms in the category with per-algorithm asset counts and a paginated sample of affected assets

A few things to know when reading the counts:

  • Preferred can legitimately read 0. The matrix counts only algorithms Mesh has actually observed. A zero means no preferred algorithm has been detected in your environment — not that the tile is broken.
  • Unclassified is a to-do list for your policy, not a clean bill of health. A large count means your policy needs additional rules, not that those assets are safe.
  • The matrix covers crypto and software assets; machine assets are not included in these counts.
  • If your organization has no active crypto compliance policy, or no data has been collected yet, the matrix reports that a data refresh is in progress instead of showing counts.
note

The Disallowed tile corresponds to the Prohibited level in your crypto compliance policy.

Fixable now​

What can we clean up today?

Certificate hygiene issues with a clear, immediate fix — unmanaged certificates, shadow or unknown CAs, expired certificates, and certificates expiring within 30 days.

Top 10 Assets to Address​

If we start migrating tomorrow, where do we start?

The highest-risk assets in the crypto estate, by name, with their type and algorithm. Selecting a row opens the asset drill-down.