How do I calculate my cryptographic debt from Harvest Now, Decrypt Later threats?

Cryptographic debt is calculated using three factors: (1) Data sensitivity and value, (2) Required confidentiality period (how long data must remain secret), and (3) Estimated timeline to cryptographically-relevant quantum computers (CRQC). If your data must stay confidential beyond the expected CRQC date, you have quantum exposure. Use the calculator to assess your cryptographic debt score in 5 minutes.

What data retention periods create the highest cryptographic debt?

Organizations with 10+ year data retention requirements face critical cryptographic debt. This includes: healthcare (HIPAA records, 6+ years), financial services (transaction records, 7+ years), government (classified data, indefinite), and legal (client records, varies by jurisdiction). With 2029 treated as a readiness/control date and external CRQC timing still uncertain, data encrypted today may be decryptable within its retention period once sufficient capability exists.

What is the quantum risk scoring methodology?

The calculator uses seven weighted factors: Industry Classification (15%), Confidentiality Horizon (25%), Data Sensitivity (15%), Exposure Surface (15%), Crypto Posture (15%), Deployment Breadth (10%), and Change Friction (10%). Algorithms are scored by Shor-vulnerability: RSA-2048 = 90, ECDSA P-256 = 85, ML-KEM = 0 (quantum-safe). Risk thresholds: Critical >=80, High >=60, Medium >=40, Low <40.

Does the quantum risk calculator require registration?

No registration is required. It takes approximately 5 minutes to complete. You can copy an evidence summary of your assessment for compliance documentation. For comprehensive cryptographic assessment, consider QScout's deeper assessment tiers.

Interactive Assessment

Quantum Risk Calculator

Assess your organization's quantum exposure in a few minutes. Get a prioritized readiness score and actionable next steps.

“What stands out across these environments isn't a lack of encryption, but a lack of prioritization. Quantifying that difference is what turns quantum readiness from a theoretical concern into an actionable program.”
Garrett Melich — Former Deputy Director Cyber & Digital Policy, CIA

Step 1 of 7

Industry

What industry does your organization operate in?

HealthcareHIPAA, ePHI requirements

Financial ServicesPCI, SOX, GLBA compliance

Federal GovernmentFedRAMP, FISMA, NIST 800-53

DefenseCMMC, ITAR, classified systems

Critical InfrastructureEnergy, utilities, transportation

SaaS / TechnologyCloud-native, multi-tenant

OtherManufacturing, retail, education

Built with Enterprise Trust

Security, privacy, and compliance embedded in every calculation

Estimates only. Not a compliance assessment.

Zero Data Collection

Results computed locally only

HIPAA-aware

Supports ePHI-sensitive workflows

Open Methodology

Published, transparent methodology

Procurement Ready

Inherited-control mapping for vendor diligence

Continue your assessment

This calculator provides directional guidance. Explore additional resources or connect with our team for a comprehensive assessment.

View PQC Checklist Get Personalized Guidance