BUILD 100 · QTA · NIST IR 8547 · 72-HOUR DELIVERABLE
Quantum Threat Assessment
Here's the IBM circuit. Here's which of your curves it broke. Here's the timeline. QTA is a 72-hour assessment that maps your cryptographic asset inventory to NIST IR 8547 migration categories, overlays sector-specific data lifetime models, and produces harvest-now-decrypt-later risk windows grounded in hardware-verified results.
THE MOSCA THEOREM
X + Y + Z > T
Michele Mosca's inequality is the organizing principle of every quantum threat assessment worth paying for. It tells you — with arithmetic, not hand-waving — whether you are already too late to migrate.
Our Q-Day horizon estimate (Z) is anchored to empirical evidence — we broke 17 ECC curves on IBM quantum hardware. That number shortens every year. Your data shelf life doesn't.
NIST IR 8547 CLASSIFICATION
Four categories. Four answers.
Every asset you own gets tagged with exactly one NIST IR 8547 category. The category determines the action.
Must transition — Shor-vulnerable
All public-key primitives that Shor's algorithm breaks. Broken on IBM hardware by us in 2025 (17 curves, ibm_fez).
Must transition — Grover-weakened
Symmetric primitives whose effective strength halves under Grover. SHA-1 and MD5 are already classically broken.
No transition required
Grover halves to 128-bit effective strength — still safely beyond brute force. Keep using these.
Under study
Primitives where the NIST classification is still evolving. QTA flags these for monitoring rather than urgent action.
SECTOR DATA LIFETIME MODEL
Your sector dictates your X.
Defense classified programs have 35-year confidentiality windows. Banking records are bound by Basel III + AML lookback to 25 years. Tech product roadmaps expire in 10. QTA overlays your sector's data lifetime on every asset and lets the math speak.
HARVEST-NOW-DECRYPT-LATER
Four risk windows. Every asset gets one.
Adversaries are recording your encrypted traffic today. Data lifetime ≥ Q-Day horizon. By the time decryption is viable, your data is still confidential. You have already been harvested.
Narrow window. Data lifetime sits 3–7 years from Q-Day. Migration must begin this fiscal year to stay ahead of the decrypt window.
Exposure is real but deferrable. Data lifetime extends beyond current monitoring window but below Q-Day horizon. Schedule for next planning cycle.
Cat 3 primitives or short-lifetime data. No quantum migration required. Focus resources elsewhere.
72-HOUR DELIVERABLE
From kick-off to signed report.
Kick-off
NDA executed. Asset inventory ingested via free-text, spreadsheet, or architecture document.
Surface enumeration
Cryptographic primitives extracted and tagged. NIST IR 8547 categories assigned to every asset.
Exposure scoring
MOSCA theorem applied: X + Y + Z > T. Sector-specific data lifetime overlaid. HNDL windows computed per asset.
Advisory cross-ref
Live KB cross-reference against CISA CNSA 2.0, NSA M-23-02, DORA Art. 6, SWIFT CSP, ETSI GR-QSC-004 (10 advisories total).
Deliverable
Executive brief (150w) + technical roadmap (400w) + SQLite-backed evidence file. SATOR-HMAC signed. Telegram digest optional.
LIVE ADVISORY CROSS-REFERENCE
Ten frameworks. One report.
Every QTA finding is tagged to the specific regulatory advisory it maps to. When the board asks “which framework requires this?” the answer is already in the deliverable.
Know your exposure.
In 72 hours.
$5,000 entry. Three-day turnaround. Executive brief + technical roadmap + live advisory cross-reference.
Every finding SATOR-HMAC signed. Every claim anchored to empirical hardware results. Acceptable to federal auditors and board risk committees.