Cryptographic discovery, migration engineering and independent evaluation.

A systematic inventory of every cryptographic asset in your estate: algorithms, key lengths, certificates and certificate authorities, crypto libraries, protocols and TLS versions, and the third-party dependencies that quietly introduce their own. Across source code, cloud services, network and on-premises systems.

This is the phase with the nearest deadline and the longest lead time. It does not depend on the final CBOM format being settled — teams that map their cryptography now will be adjusting an existing inventory in 2027 rather than starting one against a deadline.

A phased, sequenced and costed migration plan. Where most roadmaps map to one framework, ours maps simultaneously to every instrument that binds you — NIST IR 8547, EO 14412 and OMB M-26-15, CNSA 2.0 where it applies, and the NCSC 2028 / 2031 / 2035 phases.

If you operate across the UK and US, that multi-jurisdiction mapping is the difference between one plan and three that contradict each other.

The delivery work. An inventory tells you where your cryptographic dependencies live; agility determines how hard each one is to change. Without it, migration is a series of re-architecture projects instead of a series of configuration changes.

Hybrid TLS deployment, certificate and PKI re-keying including root and intermediate CA hierarchies, HSM assessment, removing hard-coded algorithm calls behind an abstraction, and PQC policy gates in your CI/CD pipeline so non-compliant code does not reach production.

An independent evaluation of any Quantum Key Distribution or QRNG proposal on your desk, assessed against current agency positions rather than vendor material.

The starting position is public: the NCSC does not endorse QKD for government or military applications, recommends PQC as the primary mitigation, and states that QKD use should not count as evidence toward data-in-transit security assessments under the Cyber Assessment Framework. The NSA does not support QKD for National Security Systems and it does not appear in CNSA 2.0. QKD provides no authentication, needs new physical infrastructure, and depends on trusted relay nodes.

There is a small set of architectures where it is defensible. We will tell you whether yours is one of them, in writing, and we have no QKD product to sell you either way.

Two days, hands-on, using your codebase as the working example rather than a toy repository. Day one covers the threat model and what quantum actually breaks, plus the NIST standards: ML-KEM, ML-DSA and SLH-DSA. Day two is implementation — hybrid TLS, certificate migration, and PQC checks in the pipeline.

A monthly briefing on what actually changed and what to do about it. Hardware progress, standards and regulatory movement, vulnerability disclosures — without the vendor press releases. Written to be forwarded to a leadership team without translation.

For clients who have completed discovery, this extends into continuous cryptographic posture monitoring: re-scanning as services deploy and certificates rotate, so the inventory does not go stale the month after it is delivered.