Q-Readiness | Dashboard

5 P0

3 P1 · 4 P2

HNDL-Urgent — Act Now

P0: keys protecting harvested data today

7 endpoints

5 HIGH · 2 CRIT

TLS & Certificate Exposure

Surveyor + testssl.sh, May 2026

12 findings

across 7 layers

Crypto Inventory Coverage

acdi + Vault + DB scan + DNSSEC

-2.9%

PQC vs Classical TLS

Performance Impact

PQC-LEO + liboqs, x86_64

Severity Distribution

40 findings across 7 tools. Source: all scan data, May 2026.

Findings by Layer

Source: acdi, testssl.sh, Vault, DB scan, DNSSEC, Surveyor, pqcscan.

PQC Adoption — 8 Major Services

Source: pqcscan 0.8.0, May 2026. Certificate identity gap: 0/8 migrated.

Top Findings — P0 & P1

Prioritized by HNDL urgency and regulatory deadlines. Source: all tool outputs.

Pri	Layer	Finding	Asset	Deadline	Tool
P0	Secrets	AWS KMS CMK using RSA-2048 — wraps PHI encryption keys with 30yr retention	terraform/aws/kms.tf:23	Q3 2026	acdi 0.5.0
P0	Database	Patient records TDE key wrapped by RSA-2048 — 500K records, 30yr retention	db-prod-01/patient_records	Q3 2026	DB scan 1.0
P0	Database	Financial transactions TDE key wrapped by RSA-2048 — 2M records, 7yr retention	db-prod-01/financial_tx	Q3 2026	DB scan 1.0
P0	TLS	Internal LDAP server: SSLv3 + POODLE + DROWN + RC4 — multiple active CVEs	internal-ldap.example.com:636	Q3 2026	testssl.sh 3.3
P0	Secrets	Ansible Vault using RSA-2048 encryption — secrets at rest exposed to HNDL	ansible/vault/encrypt.yml:5	Q3 2026	acdi 0.5.0
P1	PKI	Vault Root CA using RSA-4096 — entire internal certificate hierarchy at risk	vault: pki/ mount	Q4 2027	Vault audit 1.0

TLS Endpoints — 7 Hosts

Source: Surveyor 1.0 + testssl.sh 3.3 + pqcscan 0.8.0, May 2026.

Host	TLS	Certificate	PQC KEX	Vulnerabilities	Priority	Evidence
google.com:443	1.3	ECDSA-256	MLKEM1024	—	P2	View surveyor-scan.json: modern_tls_classical_identity
cloudflare.com:443	1.3	ECDSA-256	X25519MLKEM768	—	P2	View surveyor-scan.json: modern_tls_classical_identity
microsoft.com:443	1.3	RSA-2048	None	—	P2	View pqc-network-scan: RSA-2048, NO PQC OIDs
amazon.com:443	1.3	RSA-2048	None	—	P2	View pqc-network-scan: RSA-2048, NO PQC OIDs
internal-api:443	1.3	ECDSA-256	—	HSTS missing	P3	View testssl: TLS 1.3 OK, no HSTS header
internal-db:5432	1.1	RSA-2048	—	ROBOT, SWEET32, TLS 1.1	P1	View testssl: TLS 1.1 offered, ROBOT vuln, SWEET32 vuln
internal-ldap:636	SSLv3	RSA-1024	—	POODLE, DROWN, RC4, FREAK, Logjam	P0	View testssl: SSLv2/3 offered, POODLE vuln, DROWN vuln, RC4, FREAK, Logjam

Database Encryption — 4 Servers

Source: DB Crypto Scan 1.0 (PostgreSQL, SQL Server, MySQL), May 2026.

Database	Engine	TDE	Key Wrapping	Enc Columns	Conn TLS	Retention	Priority
patient_records	PG 16	LUKS	RSA-2048 (GPG)	3 (pgcrypto)	TLS 1.2	30yr	P0
financial_tx	PG 16	LUKS	RSA-2048 (GPG)	2 (pgcrypto)	TLS 1.2	7yr	P0
hr_records	MSSQL 22	AES-256	RSA-2048	2 (Always Enc)	TLS 1.2	10yr	P1
inventory	MySQL 8.4	AES-256	RSA-4096	—	TLS 1.3	5yr	P3

Secrets & PKI — 10 Assets

Source: acdi 0.5.0 + Vault Audit 1.0 + DNSSEC Scan 1.0, May 2026.

Source	Asset	Algorithm	Role	Priority	Evidence
acdi	aws/kms.tf:23	RSA-2048	KMS — PHI key wrapping	P0	View customer_master_key_spec = "RSA_2048"
acdi	ansible/vault:5	RSA-2048	Secrets encryption	P0	View ansible-vault encrypt_string with RSA-2048 key
acdi	gcp/kms.tf:15	ECDSA-P256	KMS — financial keys	P1	View algorithm = "EC_SIGN_P256_SHA256"
Vault	pki/ mount	RSA-4096	Root CA	P2	View key_algorithm: RSA-4096, sig: SHA384WithRSA
Vault	pki-int/ mount	RSA-2048	Intermediate CA	P2	View key_algorithm: RSA-2048, sig: SHA256WithRSA
Vault	ssh/ mount	RSA-2048	SSH CA	P2	View key_algorithm: RSA-2048, OpenSSH format
Vault	jwt/ mount	RS256	JWT signing	P3	View key_algorithm: RS256 (RSA-2048)
acdi	cosign key	RSA-2048	Code signing	P2	View .github/workflows/release.yml:42 — cosign sign --key cosign.key
acdi	DKIM selector1	RSA-2048	Email signing	P3	View k=rsa, p=MIIBIjANBgkqhki..., h=sha256
DNSSEC	internal.example	RSA-1024 ZSK	Zone signing	P2	View algorithm 8 (RSA-SHA256), ZSK key_size: 1024

TLS Handshake Performance

Source: PQC-LEO 0.5.0 + liboqs 0.15.0. Hardware: x86_64, AES-NI, AVX2.

Algorithm Combination	Category	Conn/sec	vs RSA-2048	Session Reuse
RSA-2048 (baseline)	Classical	1,284	—	5,412 (4.2x)
ECDSA-P256 + ECDH	Classical	1,456	+13.4%	5,890 (4.0x)
ML-DSA-65 + ML-KEM-768	PQC	1,247	-2.9%	5,234 (4.2x)
ML-DSA-65 + X25519MLKEM768	Hybrid	1,198	-6.7%	5,012 (4.2x)
ML-DSA-87 + ML-KEM-1024	PQC	1,103	-14.1%	4,891 (4.4x)

PQC TLS overhead: 22µs (0.04% of 50ms handshake). liboqs 0.15.0. ML-KEM-768 keygen: 10.5µs — 95x faster than RSA-2048.

Prioritized Remediation

P0: HNDL-urgent (3mo). P1: CNSA 2027 (18mo). P2: NIST 2030. P3: NIST 2035.

Pri	Layer	Finding	Asset	Action	Deadline	Status
P0	Secrets	AWS KMS RSA-2048 wrapping PHI keys	aws/kms.tf:23	Re-wrap with ML-KEM-768	Q3 2026	Not started
P0	Database	Patient records TDE RSA-2048 — 500K PHI records	db-prod-01	Rotate TDE key to ML-KEM-768	Q3 2026	Not started
P0	Database	Financial tx TDE RSA-2048 — 2M records	db-prod-01	Rotate TDE key to ML-KEM-768	Q3 2026	Not started
P0	TLS	LDAP SSLv3 + POODLE + DROWN + RC4	internal-ldap:636	Decommission SSLv2/3. Upgrade to TLS 1.3	Q3 2026	Not started
P0	Secrets	Ansible Vault RSA-2048 encryption	ansible/vault:5	Re-encrypt with AES-256 + migrate key	Q3 2026	Not started
P1	PKI	Vault Root CA RSA-4096	vault: pki/	Plan hybrid CA: ML-DSA + RSA	Q4 2027	Not started
P1	PKI	Vault Intermediate CA RSA-2048	vault: pki-int/	Plan migration to ML-DSA	Q4 2027	Not started
P1	TLS	DB connection TLS 1.1 + ROBOT + SWEET32	internal-db:5432	Upgrade to TLS 1.3. Disable RSA kex	Q4 2026	Not started
P1	Secrets	GCP KMS ECDSA-P256 for financial keys	gcp/kms.tf:15	Plan migration to ML-DSA or ML-KEM	Q4 2027	Not started
P1	Database	HR records TDE RSA-2048 — 10yr retention	db-prod-02	Rotate TDE key. Plan migration Q4.	Q4 2027	Not started
P2	PKI	Vault SSH CA RSA-2048	vault: ssh/	Plan migration before 2030	2029	Not started
P2	Code Sign	Cosign RSA-2048 signing key	release.yml:42	Migrate to ML-DSA-65	2029	Not started
P2	DNSSEC	RSA-1024 ZSK for internal.example	internal.example	Wait for DNSSEC algorithm standard	2029	Not started
P3	PKI	Vault JWT RS256 signing	vault: jwt/	Migrate with normal refresh cycle	2033	Not started
P3	Email	DKIM RSA-2048 signing	selector1._domainkey	Monitor standards. Rotate normally	2033	Not started

Regulatory Deadlines

Deadline	Date	Items Due	Scope
CNSA 2.0 Phase 1	Jan 1, 2027	5 P0 items	National security systems. Software/firmware signing.
NIST Classical Deprecation	Jan 1, 2030	5 P1 + 3 P2 items	RSA, ECDSA, ECDH deprecated. New systems must use PQC.
NIST Classical Removal	Jan 1, 2035	2 P3 items	All systems must be PQC-migrated. CRQC expected.