Enterprise infrastructure operators face a critical challenge in prioritizing post-quantum migration, as quantum-related risk is not uniformly distributed across data in transit, in use, and at rest. Existing assessments rely on system-level evaluations or protocol-specific analyses, which do not capture the heterogeneity of exposure across infrastructure layers. This paper extends the Quantum-Adjusted Risk Scoring (QARS) model introduced in into an evidence-based, layer-specific framework that evaluates in-transit, in-use, and at-rest data separately. QARS applies a unified five-factor scoring framework separately to each data state and introduces a quantum-vulnerability attenuation mechanism grounded in Grover-bounded residual security that prevents overstating urgency for non-Shor-vulnerable symmetric protection. Observable host-level evidence determines the binary and ratio descriptors used by the model, while the fixed affine mapping coefficients are treated as transparent semi-quantitative calibration parameters. These coefficients are documented separately and subjected to coefficient-level sensitivity analysis to evaluate whether the reported layer ordering depends on their nominal values. The model is demonstrated through an illustrative controlled experiment using real infrastructure observations. Strengthening storage protection reduces the aggregate system risk from 0.707 (high) to 0.414 (moderate), a 41.5% reduction. However, the maximum-layer score remains high (0.657), indicating that the transport layer continues to dominate migration urgency. Sensitivity analysis confirms that the dominance of the transport layer is stable under wide perturbations of the calibration parameters. These findings demonstrate that risk reduction in one layer does not eliminate overall exposure but shifts the dominant vulnerability. By distinguishing between overall system posture and the most critical remediation priority, QARS supports infrastructure operators in identifying high-risk components and planning structured, evidence-based post-quantum migration.
Enterprise infrastructure operators face a critical challenge in prioritizing post-quantum migration, as quantum-related risk is not uniformly distributed across data in transit, in use, and at rest. Existing assessments rely on system-level evaluations or protocol-specific analyses, which do not capture the heterogeneity of exposure across infrastructure layers. This paper extends the Quantum-Adjusted Risk Scoring (QARS) model introduced in into an evidence-based, layer-specific framework that evaluates in-transit, in-use, and at-rest data separately. QARS applies a unified five-factor scoring framework separately to each data state and introduces a quantum-vulnerability attenuation mechanism grounded in Grover-bounded residual security that prevents overstating urgency for non-Shor-vulnerable symmetric protection. Observable host-level evidence determines the binary and ratio descriptors used by the model, while the fixed affine mapping coefficients are treated as transparent semi-quantitative calibration parameters. These coefficients are documented separately and subjected to coefficient-level sensitivity analysis to evaluate whether the reported layer ordering depends on their nominal values. The model is demonstrated through an illustrative controlled experiment using real infrastructure observations. Strengthening storage protection reduces the aggregate system risk from 0.707 (high) to 0.414 (moderate), a 41.5% reduction. However, the maximum-layer score remains high (0.657), indicating that the transport layer continues to dominate migration urgency. Sensitivity analysis confirms that the dominance of the transport layer is stable under wide perturbations of the calibration parameters. These findings demonstrate that risk reduction in one layer does not eliminate overall exposure but shifts the dominant vulnerability. By distinguishing between overall system posture and the most critical remediation priority, QARS supports infrastructure operators in identifying high-risk components and planning structured, evidence-based post-quantum migration.
Quantum computing poses an unprecedented threat to classical cryptography, requiring new risk assessment paradigms. This paper proposes a Quantum-Adjusted Risk Score (QARS) model, a theoretical and methodological innovation within the EU’s PAREK framework (Post-quantum asset and algorithm inventory, risk assessment, road mapping, execution, key governance). QARS extends Mosca’s inequality—which defines a quantum threat timeline threshold—into a multi-factor risk scoring formula. We formalise QARS with mathematical expressions incorporating timeline, sensitivity, and exposure dimensions, each calibrated by factor weights and scaling functions. The design motivations for including these dimensions are discussed in depth. We present method for model calibration (including sector-specific weight adjustments) and outline validation strategies combining quantitative analysis and expert judgement. The proposed QARS model is situated in the context of the EU’s coordinated roadmap for post-quantum cryptography and cybersecurity regulations, illustrating how QARS supports compliance and strategic migration prioritisation. A prototype tool implementing QARS model is also provided to demonstrate practical applicability. Our contributions provide a unified approach to quantum risk assessment, marrying theoretical rigour with policy-relevant risk management needs to help organizations proactively address the quantum threat.
Purpose – This study develops and empirically evaluates a Quantum Exposure Index (QEI) for characterizing quantum-related exposure observable from public-sector Transport Layer Security (TLS) infrastructures and supporting post-quantum migration prioritization. Methods – The framework integrates TLS protocol version, certificate public-key algorithm, classical key-strength equivalence, and Perfect Forward Secrecy into a normalized composite index. Component weights were derived through the Analytical Hierarchy Process, while non-intrusive TLS measurements from publicly accessible government infrastructures provided the empirical inputs. Sensitivity and sector-level analyses were conducted to examine the robustness and interpretability of the resulting exposure profiles. Findings – The evaluated infrastructures remain dependent on classical public-key cryptography and therefore retain exposure to future quantum-capable adversaries despite widespread adoption of modern TLS configurations and forward secrecy. The analysis further shows that cryptographic key strength and protocol configuration differentiate exposure profiles, whereas the continued reliance on quantum-vulnerable public-key primitives establishes a common exposure baseline. Classification outcomes are sensitive to interpretive thresholds, reinforcing the importance of continuous index values over categorical labels. Research Implications – The QEI provides a reproducible infrastructure-level baseline for prioritizing cryptographic inventories, monitoring migration progress, and supporting evidence-based post-quantum transition planning. Originality – This study combines operational TLS measurement, standardized cryptographic-strength mapping, and multicriteria weighting within a unified quantitative framework for assessing observable quantum exposure in public-sector infrastructures.
Abstract—The progression of quantum computing presents a prospective threat to classical public-key cryptographic systems widely used in enterprise data infrastructures. This study proposes a structured, analytics-driven framework to support organizational migration toward quantum-safe cybersecurity. The five-phase model integrates cryptographic asset inventory, probabilistic risk modeling, post-quantum control selection, phased implementation, and continuous monitoring.A Monte Carlo–based simulation estimates potential vulnerability windows for RSA and ECC under varying qubit growth scenarios, enabling data-driven risk prioritization. Performance benchmarking of selected post-quantum cryptographic schemes was conducted using Open Quantum Safe (OQS) libraries across 10,000 runs to evaluate computational overhead and scalability characteristics. Organizational readiness was assessed through survey analytics (n = 25) and Delphi-based expert validation (n = 15), providing structured consensus on implementation feasibility.A controlled enterprise pilot demonstrated measurable reductions in migration planning time (approximately 82% within scope) alongside high usability acceptance (SUS score: 84/100). Findings suggest that integrating predictive modeling, performance analytics, and governance planning can enhance preparedness for long-term quantum risk while maintaining operational stability. The framework contributes to applied data analytics and communication network security by offering a quantitatively informed pathway for enterprise cryptographic transition. Index Terms—quantum-safe cryptography, post-quantum mi- gration, quantum computing, cryptographic inventory, hybrid TLS, cybersecurity frameworks
Enterprise wide-area networks (WANs) use quantum-vulnerable public-key cryptography to authenticate peers and establish keys for Internet Protocol Security (IPsec), Transport Layer Security (TLS), and software-defined WAN services. Harvest-now, decrypt-later collection already threatens data whose protection lifetime may exceed the time needed to migrate, while a future cryptographically relevant quantum computer would also endanger certificates and other authentication dependencies. Post-quantum standards and government directives now define algorithms and transition milestones, but they do not tell an enterprise which WAN services to migrate first or what evidence is sufficient for deployment. This paper proposes a vendor-neutral framework that separates exposure priority, migration readiness, and evidence confidence, and maps those outputs to staged security, operational, and governance gates. It also defines a complete evaluation design for classical and ML-KEM hybrid key establishment in TLS 1.3 and IKEv2/IPsec. The retained artifact is narrower: it contains author-reported aggregate TLS p50, p95, and p99 latencies at configured loss settings of 0%, 1%, 3%, and 5%, an arithmetic checker, and limited environment and MTU/MSS notes. At those settings, the TLS-H minus TLS-C p95 differences are 0.00, 0.16, 0.38, and 0.63 ms, corresponding to 0.00%, 1.32%, 3.07%, and 5.00% relative to TLS-C. These values are descriptive aggregate observations, not inferential results, because per-trial data, sample counts, original captures, and timestamped logs were not retained. Protocol-size and MTU/MSS calculations are reported separately from measured behavior, and unsupported IKE, resource, throughput, retransmission, and downgrade outcomes are excluded.
This chapter presents a structured methodology for prioritizing cryptographic systems for post-quantum remediation based on business risk, data sensitivity, and exposure. Building on earlier cryptographic inventory and vulnerability assessment work, it introduces a decision-making framework that incorporates business impact analysis (BIA), data privacy duration, and threat surface exposure. Readers are guided through evaluating TLS traffic, VPNs, secure email, PKI, and authentication systems to identify assets most susceptible to Harvest Now, Decrypt Later (HNDL) attacks and long-term decryption threats. These insights drive targeted prioritization efforts that align with business goals, regulatory mandates, and quantum readiness strategy. The chapter offers both qualitative and quantitative approaches, including the use of scoring rubrics and heatmaps, to help assign systems into critical, high, medium, or low remediation tiers. It integrates tools from vendors like Sandbox AQ, IBM, and ISARA with models such as FAIR (Factor Analysis of Information Risk) to support risk quantification in financial and operational terms. The framework also includes dependency mapping to uncover hidden trust relationships and downstream vulnerabilities, enhancing system-level resilience. Exception handling and justification protocols are introduced to manage legacy systems or high-friction upgrades, providing accountability and traceability while maintaining forward momentum.
The rise of large-scale quantum computing poses a significant threat to traditional cryptographic security measures. Quantum attacks, particularly targeting the mathematical foundations of current asymmetric cryptographic algorithms, render them ineffective. Even standard symmetric key cryptography is susceptible, albeit to a lesser extent, with potential security enhancements through longer keys or extended hash function outputs. Consequently, the cryptographic solutions currently employed to safeguard data will be inadequately secure and vulnerable to emerging quantum technology threats. In response to this impending quantum menace, organizations must chart a course towards quantum-safe environments, demanding robust business continuity plans and meticulous risk management throughout the migration process. This study provides an in-depth exploration of the challenges associated with migrating from a non-quantum-safe cryptographic state to one resilient against quantum threats. We introduce a comprehensive security risk assessment framework that scrutinizes vulnerabilities across algorithmic, certificate, and protocol layers, covering the entire migration journey, including pre-migration, through-migration, and post-migration stages. Our methodology links identified vulnerabilities to the well-established STRIDE threat model, establishing precise criteria for evaluating their potential impact and likelihood throughout the migration process. Moving beyond theoretical analysis, we address vulnerabilities practically, especially within critical components like cryptographic algorithms, public key infrastructures, and network protocols. Our study not only identifies potential attacks and vulnerabilities at each layer and migration stage but also suggests possible countermeasures and alternatives to enhance system resilience, empowering organizations to construct a secure infrastructure for the quantum era. Through these efforts, we establish the foundation for enduring security in networked systems amid the challenges of the quantum era.