Products
Platform capabilities
Programs
Identity & PKI
Regulated
Product & infrastructure
Tools
Reference
Post-quantum cryptography · Threat modeling · Identity
210 Security finds quantum-vulnerable cryptography, models how an adversary would attack the systems around it, and runs the remediation — with the PKI, identity, and Zero Trust expertise to make it stick.
The standards we work to
Products
Cipher Posture finds and fixes quantum-vulnerable cryptography. Threat Model Agent models the whole system — trust boundaries, abuse cases, identity delegation, application risk, and cryptography — and re-models as the architecture changes. They share an inventory when used together.
Find, rank, and fix every quantum-vulnerable algorithm.
Discover → Migrate → Operate
Discover
Every algorithm, key, and certificate, including inherited dependencies.
Analyze
Sequence by data lifespan, obligation, and migration cost.
Migrate
Hybrid TLS, PQC issuance, and quantum-safe signing, staged and reversible.
Operate
Continuous drift detection and audit-ready evidence.
From any description to a threat model you can act on.
Design → Develop → Operate
Ingest
Notes, repositories, documents, diagrams, SBOMs and CBOMs — mixed in one run.
Model
Components, data flows, trust boundaries and assumptions, reviewed before analysis.
Analyze
The frameworks you choose, compliance mapping, scanners and a PQC pass.
Act
Evidence-checked threats, fixes with Where and Verify, tracking and PR checks.
The clock
This is no longer a research question. It is a set of dated obligations that arrive through acquisition, procurement, and audit — and each one needs an inventory you probably do not have yet.
Dates below are drawn from public policy. We link every one to its primary source, and we say so when a document is still a draft.
January 1, 2027
CNSA 2.0 becomes the acquisition default
December 31, 2030
PQC key establishment on high-value and high-impact systems
December 31, 2031
PQC digital signatures on high-value and high-impact systems
Countdowns computed in your browser
Full timeline, with sourcesWhy this is hard
NIST IR 8547 proposes deprecating RSA, ECDSA, EdDSA, and classical Diffie-Hellman after 2030 and disallowing them after 2035. The document is still a draft; the direction is not.
NIST IR 8547 · draft
EU Cyber Resilience Act reporting duties began on 11 September 2026, with full manufacturer obligations from 11 December 2027. Risk assessment and technical documentation are expected — a model nobody can produce on request is a liability.
EU CRA · 11 September 2026
Traffic captured today can be decrypted once a cryptographically relevant quantum computer exists. If the data must stay secret for 10–15 years, waiting is an accepted exposure.
Harvest now, decrypt later
Most organizations can name their crown jewels. Far fewer can show the threat model that explains how an attacker reaches them.
Services
The products tell you what to do. Our consultants do the work with your team — on threat modeling, Zero Trust, agentic identity, PKI, and IAM, where the migration either holds or falls apart.
From no inventory to a board-approved roadmap.
Workload identity, delegation, and short-lived credentials for autonomous systems.
CA hierarchies, HSM integration, and certificate lifecycle at fleet scale.
Least privilege, non-human identity inventory, and federation that survives the transition.
From one model to a program the team owns.
Identity-centric segmentation, workload identity, and continuous verification.
How we work
Fixed scope, fixed duration, and a deliverable your sponsor can take to a board. If the inventory cannot support a decision, we say so before you spend the migration budget.
We discover what you actually run, resolve ownership, and produce a versioned CBOM. No assumptions, no inherited blind spots.
We rank by harvest-now-decrypt-later exposure and obligation, then agree the roadmap, owners, and the first migrations.
We migrate in reversible steps and leave behind the automation, policy, and evidence that keeps the estate at standard.
Where we start
A federal contractor, a payments processor, and a utility share the same algorithm problem and none of the same constraints. Choose the door that matches your deadline.
CNSA 2.0 readiness, cryptographic inventory, and contractor FAR compliance.
New NSS acquisitions are expected to be CNSA 2.0-compliant by default from January 1, 2027.
HNDL exposure, long-lived records, and audit-ready cryptographic evidence.
Data that must stay confidential for 10–15 years can be considered exposed to harvest-now-decrypt-later collection today.
Code signing, CBOM delivery, and the questionnaires your buyers now send.
CNSA 2.0 requires ML-DSA or LMS/XMSS for software and firmware signing; larger RSA or ECDSA keys do not satisfy it.
Long asset life, constrained devices, and migrations that cannot take the plant down.
The executive order directs sector risk management agencies to help critical infrastructure owners develop PQC migration plans.
Threat modeling, delegation, and Zero Trust for autonomous systems.
OWASP's Top 10 for Agentic Applications 2026 leads with goal hijack, tool misuse, and identity and privilege abuse.
Run Threat Model Agent against one service group and review the output with your security architects before committing to a program.
4–6 weeks
Before you talk to us
We would rather you arrive with context than with a vague worry. These are free, ungated, and sourced.
Fourteen questions across cryptography and threat modeling. A score, your weakest domains, and a first-90-days plan. No email to see the result.
10 minutes
Every deadline that matters between now and 2035, each one linked to its primary source.
13 milestones
What a cryptographic bill of materials contains, why regulators now ask for one, and how to build it.
12 min read
A one-page structure for modeling an agent: tools, identity, delegation, trust boundaries, and abuse cases.
Workshop template
A public, annotated library of primary security sources. No products, no lead capture.
24 sources
Plain definitions for ML-KEM, ML-DSA, hybrid key exchange, crypto agility, HNDL, and the rest.
20 terms
FAQ
Short answers. If yours is not here, ask it directly — we answer email.
Post-quantum cryptography is a set of algorithms designed to resist attack by both classical and quantum computers. NIST standardized the first three in August 2024: ML-KEM for key establishment, and ML-DSA and SLH-DSA for digital signatures. They are intended to replace RSA and elliptic-curve cryptography, which a sufficiently large quantum computer could break.
Because encrypted data can be captured now and decrypted later. If your data must stay confidential for more than 10–15 years, waiting is not a neutral decision — it is an accepted exposure. The regulatory deadlines also assume you start early: new national-security acquisitions expect CNSA 2.0 from January 2027, and federal high-value systems have PQC requirements by 2030 and 2031.
A system threat model with trust boundaries and data flows, a threat register with owners and mitigations, abuse cases and security test cases, and change diffs when the architecture moves. It is not a crypto-only model: application, identity, and abuse-case threats are first-class, and the CBOM and identity inventory are inputs when available.
No. Scanners find implementation defects in code that already exists. The agent starts from the architecture and asks what an adversary would do to it. Scanner findings can be an input, but they are not the model.
A cryptographic bill of materials is a machine-readable inventory of the cryptographic assets in a system: algorithms, keys, certificates, protocols, and the libraries that implement them. The July 2026 executive order directs CISA and NIST to publish minimum CBOM elements, which will make it a standard procurement artifact rather than a good idea.
No. We work alongside them. Most of our engagements leave your team with automation, policy, and runbooks they own. Where we build, we build with your engineers pairing on the work so the knowledge stays after the engagement ends.
Next step
A 45-minute readiness briefing: your obligations, your exposure, and the first three things to fix. No slideware.