# PQC Readiness

Your cryptographic estate's post-quantum posture in one view: how many assets
are in scope, who owns them, how they measure against your crypto compliance
policy, and which ones to address first.

![The PQC Readiness view composed on a live tenant — estimated assets in scope, ownership and orphan assets, compliance status, quantum-vulnerable assets, the Algorithm Posture Matrix, fixable-now issues, and the top 10 assets to address](/img/generative-ui/view-pqc-readiness.png)

## Estimated assets in scope

*How big is the problem?*

The total count of software and cryptographic assets Mesh has discovered in
your environment, split by kind. Selecting a count opens the asset list,
pre-filtered to that kind.

## Ownership & Orphan Assets

*Who is responsible for what — and what has no owner at all?*

A quadrant of owner-assigned vs. no-owner against linked vs. not-linked assets.
The bottom-right cell — no owner, no link — is your orphan population: assets
nobody would think to migrate. Selecting a cell opens the asset list with those
filters applied.

## Compliance Status

*How much of the estate meets the active crypto policy?*

Compliant, non-compliant, and unknown shares of your assets, judged against the
organization's in-force crypto compliance policy.

## Quantum-vulnerable assets

*How much of the estate is exposed to quantum attack?*

The share of assets using quantum-vulnerable cryptography, with unknowns
reported honestly rather than counted as safe.

## Algorithm Posture Matrix

*Of everything we discovered, how much uses algorithms our policy considers
good, aging, or unacceptable?*

Every discovered asset is graded against your organization's active crypto
compliance policy into five tiles — Preferred, Acceptable, Deprecated,
Disallowed, and Unclassified (observed, but not yet graded by your policy).
The grading is read from your policy, not a fixed industry list, and key size
is part of the grade: a policy with a 3072-bit floor grades RSA-2048 as
Disallowed and RSA-4096 as Acceptable.

![The Algorithm Posture Matrix widget showing live counts of assets graded into Preferred, Acceptable, Deprecated, Disallowed, and Unclassified tiles](/img/generative-ui/algorithm-posture-matrix.png)

Select a tile to open a drill-down that lists which algorithms make up the
category, how many assets use each one, and a sample of those assets:

![The Disallowed drill-down listing the algorithms in the category with per-algorithm asset counts and a paginated sample of affected assets](/img/generative-ui/algorithm-posture-matrix-drilldown.png)

A few things to know when reading the counts:

- **Preferred can legitimately read 0.** The matrix counts only algorithms Mesh
  has actually observed. A zero means no preferred algorithm has been detected
  in your environment — not that the tile is broken.
- **Unclassified is a to-do list for your policy**, not a clean bill of health.
  A large count means your policy needs additional rules, not that those assets
  are safe.
- The matrix covers crypto and software assets; machine assets are not included
  in these counts.
- If your organization has no active crypto compliance policy, or no data has
  been collected yet, the matrix reports that a data refresh is in progress
  instead of showing counts.

> **note**
The **Disallowed** tile corresponds to the **Prohibited** level in your
[crypto compliance policy](../../concepts/policies.md#what-a-crypto-compliance-policy-contains).

## Fixable now

*What can we clean up today?*

Certificate hygiene issues with a clear, immediate fix — unmanaged
certificates, shadow or unknown CAs, expired certificates, and certificates
expiring within 30 days.

## Top 10 Assets to Address

*If we start migrating tomorrow, where do we start?*

The highest-risk assets in the crypto estate, by name, with their type and
algorithm. Selecting a row opens the asset drill-down.