Resources
Useful before you talk to us.
Nothing here is gated. If the assessment tells you that you do not need help yet, that is a good outcome — and we would rather earn the next conversation than capture an email today.
Tools & reference
Start with the thing you need.
Five resources for the first questions: how exposed are we, what is due when, what is a CBOM, what does that word mean, and how do we model an agent.
Readiness score
Fourteen questions across cryptography and threat modeling. A score, your weakest domains, and a first-90-days plan. No email to see the result.
10 minutes
Compliance timeline
Every deadline that matters between now and 2035, each one linked to its primary source.
13 milestones
CBOM explained
What a cryptographic bill of materials contains, why regulators now ask for one, and how to build it.
12 min read
Agent threat model
A one-page structure for modeling an agent: tools, identity, delegation, trust boundaries, and abuse cases.
Workshop template
Security Reading Room
A public, annotated library of primary security sources. No products, no lead capture.
24 sources
Glossary
Plain definitions for ML-KEM, ML-DSA, hybrid key exchange, crypto agility, HNDL, and the rest.
20 terms
Writing
Field notes.
Practical writing on the parts of this transition that are hard to find good material on.
- October 28, 2026 What changed in threat modeling in 2026 Continuous models, agentic threats, a consolidated tooling market, and a legal obligation. What actually changed this year, with sources.
- October 23, 2026 A reference pipeline for post-quantum code signing Eight stages, mandatory dual signing, stateful key custody, and an illustrative signing-step config for moving code signing to post-quantum algorithms.
- October 23, 2026 What CNSA 2.0 doesn't approve — and why it matters CNSA 2.0 approves ML-KEM-1024 and ML-DSA-87 and requires LMS or XMSS for signing. It does not approve SLH-DSA for national security systems. Here is what that changes.
Next step
Find out what you are actually running.
Cipher Posture finds and fixes quantum-vulnerable cryptography. Threat Model Agent models the whole system. Start with the readiness assessment.