Product Launch
We Just Launched an Independent Scoring Platform for Post-Quantum Cryptography at RSAC 2026. Here Is What It Found.
Key Takeaways
- Qtonic Quantum Lab evaluated PQC solutions across 10 scoring dimensions and found wide variance in real-world performance despite universal vendor claims of quantum-safe readiness.
- Independent, evidence-based testing fills the gap between vendor marketing and buyer confidence, replacing trust with measurable implementation data.
- Lab scoring feeds directly into QScout assessments and QSolve migration roadmaps, creating a closed loop from evaluation to enterprise deployment.
Editorial diagram
PQC readiness histogram with score tiers, methodology dimensions, and buyer action thresholds.
NIST standardized post-quantum cryptography in August 2024. Eighteen months later, determining which products are actually production-ready remains an open question. Hundreds of vendors claim quantum-safe capabilities. Buyers have had three options: trust vendor marketing, rely on analyst reports with limited technical depth, or conduct expensive internal testing. We built a fourth option.
The Problem
The post-quantum cryptography market is growing faster than the evidence base supporting it. FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA) gave the industry concrete standards to implement against. But standards define correctness—they do not measure readiness. An implementation can be standard-compliant and still fail in production due to performance degradation, incomplete algorithm coverage, missing hybrid modes, or absent key management integration.
Enterprise procurement teams face a gap. The vendor says quantum-safe. The datasheet lists FIPS 203 support. But nobody has measured whether that implementation actually works at enterprise scale, integrates with existing infrastructure, or handles the edge cases that production environments generate daily.
What We Built
Qtonic Quantum Lab is an independent evaluation platform that scores post-quantum cryptography implementations across 10 published dimensions. As of launch, the platform covers 215 implementations spanning 12 categories:
- Cryptographic libraries—liboqs, OpenSSL, BoringSSL, wolfSSL, and others
- Hardware security modules from Thales, Entrust, and Futurex
- Key management platforms including Keyfactor, Venafi, and IBM
- Browser implementations across Chrome, Firefox, and Edge
- VPN solutions with PQC key exchange
- Silicon vendors integrating PQC at the hardware level
Each implementation is evaluated against 10 dimensions with published weights and thresholds. The dimensions cover algorithm correctness, performance characteristics, integration maturity, hybrid mode support, key management compatibility, documentation quality, compliance mapping, operational resilience, interoperability, and update cadence.
Every result includes a published signature trail and an Ed25519-signed proof manifest.
The scoring platform practices what it evaluates. All published scores carry a cryptographic signature using the same post-quantum standard the platform measures implementations against.
What We Found
The average score across all 215 implementations is 51.8 out of 100. Only 3 implementations achieved the highest confidence tier. The scoring histogram shows heavy concentration in the lower half of the scale, with a long tail toward higher scores.
This is not a failure of the vendors. It reflects the maturity curve of a standards ecosystem that is 18 months old. Many implementations cover the core algorithms correctly but lack the integration depth, hybrid mode support, or operational tooling that enterprise deployments require.
The PQC market has a readiness problem. Not a standards problem. Not a research problem. A readiness problem.
The gap between “we support ML-KEM” and “we can replace your RSA-2048 key exchange in production without downtime” is where most implementations fall short.
How It Fits
Lab intelligence feeds directly into the Qtonic Quantum product pipeline:
- QScoutuses Lab scores to identify replacement implementations during cryptographic discovery. When QScout finds RSA-2048 in your TLS configuration, Lab data tells you which ML-KEM implementation is production-ready for that use case.
- QStrikeuses Lab scores to contextualize quantum threat exposure. An implementation scoring 80/100 in the Lab presents different operational risk than one scoring 35/100.
- QSolveuses Lab data to build migration roadmaps grounded in implementation evidence rather than vendor claims, matching workload criticality to implementation confidence.
Why This Matters
Three procurement challenges the Lab addresses directly:
- Evidence-based vendor selection. Instead of comparing marketing claims, procurement teams can compare scored implementations across standardized dimensions. The same rubric applies to a cryptographic library and a hardware security module.
- Risk visibility.Not every workload requires the highest-scoring implementation. The Lab enables matching implementation confidence to workload criticality—a 45/100 implementation may be appropriate for a development environment while production systems require 75 or higher.
- Audit readiness. With 215 solutions scored across 10 published dimensions, organizations can document their vendor selection rationale with independent evidence rather than internal opinion.
Transparency
The complete scoring rubric is publicly available atqtonicquantum.com/lab/methodology. Every dimension, weight, threshold, and scoring criterion is documented. We are not aware of another PQC evaluation platform that publishes its rubric at this level of detail.
Theleaderboardis live. Thestandards mappingis published. Thechangelogtracks every scoring update. If an implementation improves, its score updates. If a new vulnerability is disclosed, affected scores are recalculated.
Sources: NIST FIPS 203, 204, 205 (Aug 2024); NIST IR 8547 (Nov 2024); Qtonic Quantum Lab internal evaluation data (215 implementations, 10 dimensions, scores current as of March 30, 2026).
Disclaimer: Qtonic Quantum Corp is a vendor in the post-quantum cryptography market. Lab scores are produced using a published methodology and are subject to the limitations described in ourmethodology documentation. Scores reflect point-in-time evaluation and may change as implementations are updated.