02 · Risk prioritization
Risk is a function of how long the data must stay secret.
Every finding is scored against data lifespan, regulatory obligation, business criticality, and migration cost — so the roadmap defends itself in front of a board.
The problem
What this stage removes.
A flat list of 40,000 vulnerable assets is not a plan. Teams either freeze or spend a quarter on the easiest work. Neither reduces the exposure that matters: long-lived confidential data that can be harvested today and decrypted later.
HNDL exposure scoring
Model harvest-now-decrypt-later risk from confidentiality lifetime, adversary access, and asset reachability rather than from algorithm alone.
Standards mapping
Map each asset to NIST IR 8547 deprecation and disallowance dates, CNSA 2.0 requirements, and FIPS 140-3 validation status.
Business context
Weight by system criticality, contractual obligations, and the cost and blast radius of migration.
Sequenced roadmap
Generate a remediation order with owners, estimates, and milestones that map to the deadlines you actually have to meet.
Capabilities
What it actually does.
Capability detail, not marketing categories.
HNDL exposure scoring
Model harvest-now-decrypt-later risk from confidentiality lifetime, adversary access, and asset reachability rather than from algorithm alone.
Standards mapping
Map each asset to NIST IR 8547 deprecation and disallowance dates, CNSA 2.0 requirements, and FIPS 140-3 validation status.
Business context
Weight by system criticality, contractual obligations, and the cost and blast radius of migration.
Sequenced roadmap
Generate a remediation order with owners, estimates, and milestones that map to the deadlines you actually have to meet.
Board-grade reporting
Translate cryptographic findings into exposure, cost, and time-to-compliance without losing the technical detail underneath.
Policy targets
Set approved algorithm suites and enforce them as policy so new violations are caught at introduction, not at audit.
Output
What you get at the end.
- Prioritized remediation roadmap
- Risk register with owners and target dates
- Board memo and executive briefing pack
- Approved algorithm policy by system class
Coverage
Where it connects.
- GRC platforms and risk registers
- ServiceNow and Jira workflows
- SIEM and security analytics
- CMDB and service catalogues
Services
The work behind the capability.
Platform output only matters if someone acts on it. These engagements deliver the change.
Next step
Find out what you are actually running.
Cipher Posture finds and fixes quantum-vulnerable cryptography. Threat Model Agent models the whole system. Start with the readiness assessment.