Readiness assessment — cryptography and threat modeling

01 Inventory & discovery 2 questions

Do you know what cryptography you run, including what you inherited?

Do you maintain a machine-readable inventory of the algorithms, keys, and certificates in production?

0 Not at all 1 Spreadsheets and periodic surveys 2 Partially automated discovery 3 Continuous, versioned CBOM

Can you identify cryptography introduced through dependencies, container images, or firmware?

0 Not at all 1 Only when a vendor discloses it 2 Some scanning in CI 3 Continuous artifact and firmware analysis

02 Risk classification 2 questions

Can you separate the exposure that matters from the noise?

Do you know which systems protect data that must stay confidential for more than ten years?

0 Not at all 1 Anecdotally, by system owner 2 For major systems only 3 Classified and mapped to every asset

Is remediation prioritized by exposure and data lifespan, rather than by which asset is easiest to see?

0 Not at all 1 By generic severity score alone 2 Partly, with business context 3 Modeled HNDL exposure, sequenced

03 Threat modeling 2 questions

Do your threat models describe the system you run today, and do they include identity and cryptography?

Do you maintain a threat model for each production system, and does it change when the architecture does?

0 Not at all 1 One-time design reviews 2 Some systems, versioned 3 Continuous and architecture-aware

Does the model cover identity delegation and cryptographic threats, or only application-layer risks?

0 Not at all 1 Application-layer risks only 2 Partly, for major systems 3 Identity, cryptography, and abuse cases in scope

04 Cryptographic agility 2 questions

How fast can you change an algorithm without an outage?

How long would it take to re-issue every certificate in your estate?

0 Months, largely manual 1 Weeks, mostly manual 2 Days, with partial automation 3 Hours, fully automated

Could you run hybrid post-quantum key exchange on your external services within a quarter?

0 Not at all 1 Only on a pilot service 2 On most services, with effort 3 Already partially deployed

05 PKI & certificate lifecycle 2 questions

Is the certificate infrastructure ready for algorithm rollover?

Do you know which HSMs and cryptographic modules support ML-KEM or ML-DSA today, and which are in the validation queue?

0 Not at all 1 We track vendor announcements 2 Some modules validated or queued 3 Fully mapped, with a refresh plan

Is certificate lifecycle automated, including renewal and revocation?

0 Manual 1 Partly automated 2 Mostly automated 3 Fully automated with monitoring

06 Identity & AI agents 2 questions

Are non-human and agent identities inventoried, scoped, and revocable?

Do you have an inventory of non-human identities — service accounts, workloads, and AI agents?

0 Not at all 1 Partial and human-maintained 2 For workloads, but not agents 3 Complete and continuously updated

Can you attribute and revoke an AI agent's access within minutes?

0 Not at all 1 With significant manual effort 2 For some agents 3 Yes, via short-lived credentials and audit

07 Governance & evidence 2 questions

Can you prove your posture, and stop it from regressing?

Is there an approved algorithm policy that new systems must follow?

0 Not at all 1 Informal guidance 2 Published policy, not enforced 3 Enforced in CI/CD

Could you produce cryptographic evidence for an auditor within a week?

0 Not at all 1 Only with a large manual effort 2 Mostly, from existing exports 3 Continuously, from a system of record

Your score

0 / 100

Not started

Answered 0 / 14

Results are computed in your browser. No email required.

How to answer

0 Nothing in place
1 Partial, manual
2 Largely in place
3 Automated

Method

How the score is calculated.

Each question is scored 0 to 3, equally weighted within its domain. The overall score is normalized to 100 across answered questions. Domains are ranked, and your three lowest become the recommended focus.

Score	Tier	What it usually means
0 – 24	Exposed	Inventory is incomplete and the migration has not started. Highest near-term risk.
25 – 49	Emerging	Partial visibility. The program depends on individuals rather than systems.
50 – 74	Managed	Real visibility and some agility. Remaining risk sits in long-lived data and signing.
75 – 100	Leading	Ahead of most organizations. Focus shifts to continuous proof and supplier coverage.

Tiers describe posture, not compliance. A high score does not mean you have met a regulatory obligation.

What this is not

A structured self-assessment, not an audit. It surfaces the gaps that most often delay programs; it does not replace discovery against your actual estate.

Privacy

Answers are held in session storage in your browser and discarded when the tab closes. Nothing is transmitted unless you submit the report form, and nothing is shared with third parties.

About the assessment

Reasonable questions.

If something is unclear, ask before you answer twelve questions.

Do I have to give you my email to see the score?

No. The score, your weakest domains, and the recommended first 90 days are shown immediately, in your browser. No email is requested.

Is any of my data sent anywhere?

No. The assessment runs entirely in your browser. Answers are held in session storage and are discarded when you close the tab. Nothing is submitted.

How accurate is the score?

It is a structured self-assessment, not an audit. It is designed to surface the gaps that most often delay security programs: incomplete inventory, unclassified data lifespan, manual certificate lifecycle, and threat models that stop at design. Treat it as a conversation starter with your team.

How ready are your cryptography and threat models?

How the score is calculated.

What this is not

Privacy

Reasonable questions.

Turn the score into a plan.