You can't migrate the cryptography you can't see.

Every evidence path, one inventory

Live handshakes and readiness probes, endpoint sensors, read-only key and identity discovery, certificate sources, code and file analysis, and your CMDB feed one estate: network and certificate evidence builds the CBOM, and code, file and packet-capture analysis catch what never crosses the wire — so nothing in the estate stays dark.

OT, IoT, and mainframe in reach

Protocol probes for Modbus (read-only device identification), DNP3, S7comm, EtherNet/IP, OPC UA, MQTT and RTSP/ONVIF; BACnet/IP and CoAP identified by port; TN3270E and IBM MQ through the TLS scan — the 10-to-20-year-lifecycle assets generic scanners miss. A 77-family algorithm knowledge base — every rating operator-tunable, though the list itself is fixed: an in-house or national algorithm outside the shipped 77 cannot be added — behind 114 probes per host maps every finding to a named migration recommendation, not a bare "unknown."

Quantum and classical, one score

Every observation is scored on two independent axes — Shor-era quantum status and classical hygiene — then collapsed to a single 0–100 risk score and a five-level severity band. Key-size escalation means a 1024-bit RSA key is reported broken, not laundered into "ok" by a family default. Beside the Technical Gap sits a Business Risk view: the gap weighted by data sensitivity and harvest-now-decrypt-later exposure. Urgency and money can rank assets differently, so PQCA shows both and never merges them.

HNDL grounded in Mosca's inequality

Harvest-now-decrypt-later exposure is computed per asset from data retention versus a calendar-anchored quantum horizon, so migration deadlines actually come due instead of forever receding. Un-curated assets surface as a data-quality gap, never a false clean bill of health.

Exposure priced in your currency

A transparent model whose impact anchors you set turns technical risk into money, so leadership prioritizes in dollars, or dinar. Figures display in any of 10 currencies, 8 of them MENA — no outbound call required.

Every mandate, one readiness number

Your reported roadmap progress is scored against 22 frameworks and 86 individually scored controls — CNSA 2.0, NIST IR 8547, FIPS 140-3 / CMVP module transition (tracking), PCI DSS 4.0, PCI PTS HSM, DORA, the EU CRA, UK NCSC, BSI, ANSSI, CCCS, ASD, ISO/IEC 18033-2 and IETF TLS, plus the MENA regulators (SAMA, CBJ, CBK, the UAE — and Saudi NCA’s general cryptographic-hygiene controls) scored natively rather than force-fit into a US framework — into one number, with per-control met / partial / gap evidence. For FIPS 140-3 specifically, PQCA tracks your plan to move onto CMVP-certified modules. It does not validate modules, and it is not a substitute for CMVP.

Deployment-aware verdicts

Because ANSSI, BSI, ASD, and CNSA 2.0 disagree on hybrid versus pure PQC, PQCA judges every negotiated key exchange against each of the four that applies to you — so "we deployed ML-KEM" gets the right answer for each jurisdiction, not a hopeful one.

Policy-as-code, no policy engine

Start with a sentence — banned and approved families with minimum key sizes like RSA<3072 — and graduate to a portable, schema-validated JSON policy with a tiered ladder and first-match-wins rules. Violations are detected against the live estate with no false positives on unknown key sizes, and sunset dates tighten the policy automatically as deadlines pass.

Five phases, standards-aligned

A fixed, ordered roadmap aligned to the CBJ sectoral roadmap and NIST migration guidance, with admin-editable timeline windows. Every install opens with a common 30-item baseline under 10 high-level items, so you begin with a plan, not a blank page.

Discovery to backlog in one click

Generate-from-inventory turns every quantum-vulnerable asset, certificate, and application into an owned, dated, priority-ranked task — deduplicated and linked to the exact item it migrates. The same estate the platform scanned becomes the plan the team works.

QRC-Budget, rolled up by phase

Every action item tracks cost, paid, and computed remaining, aggregated per phase and across the whole program in your display currency. A CISO sees committed-versus-paid-versus-still-needed at a glance, with server-side guards that keep the figures internally consistent.

Readiness that tracks real work

Every install opens with a common 30-item baseline plan under 10 high-level items, viewable Detailed or High-level. Applying a framework links its controls to the items that do that work — the cryptographic inventory nine regulators require is one item, not nine — and readiness is scored from those items’ real progress.

Built for enterprise scale

PQCA is production software for large, regulated environments — not a pilot tool or a consultant's script. It runs across segmented networks, data centers and OT plants; Active Directory groups map to any of the four roles (Administrator, Checker, Maker, Read Only); a directory import that grants more than Read Only is governed exactly like a role change. Maker and Checker provide a maker-checker (four-eyes) control over governed changes, and unattended integrations use separate service keys with least-privilege roles — importer, traffic sensor, CA sensor, HSM sensor and federation — each confined to its own endpoints; sensors report only to their own TLS port (9843), never the console port. Every scan, score, export and decision is written to an audit trail the application only ever appends to, with the acting user, the timestamp and the before-and-after state; it is not hash-chained; a full restore keeps the live trail and adds the archive’s entries, so forward it to your SIEM if you need tamper-evidence held outside the platform. Deploy per region or per subsidiary, each instance sovereign to its own jurisdiction and data-residency rules — on hardware you already own, integrated with the directory and SIEM you already run.

No telemetry, no license check-in, no update poll

PQCA picks only two destinations itself, and both wait for an administrator: an optional exchange-rate refresh (skip it by typing rates in; ten offline rates ship) and the Proxy tab’s connection test. All HTTP traffic leaves one way: direct, or through your organization’s HTTP proxy (TLS stays end to end; proxy environment variables are never read).

Every other connection goes only to the host or cloud region you configure, and none is contacted until you enable it: ticketing and chat (ServiceNow, Jira, ManageEngine ServiceDesk Plus, Slack or a generic webhook), read-only cloud key, identity and inventory connectors (AWS, Azure, Google Cloud, Entra ID, Okta, SailPoint, Qualys, DigiCert, Entrust), scheduled inventory pulls from your CMDB, Master-to-subsidiary federation reads, your SMTP relay or Microsoft 365, your SIEM over syslog/CEF, and your Active Directory. Once enabled, several of those run on a schedule without an operator present.

The web console loads nothing from the internet: no CDN, no fonts, no analytics. One codebase installs four ways — Docker, an offline Docker bundle, native Windows, or native Ubuntu — and three of the four run on networks with no internet at all.

One group, every entity

A Master PQCA links each subsidiary, reads its posture on a schedule and reports the group side by side — group exposure, mean readiness, the weakest entity and the soonest mandate — while every subsidiary’s data stays in its own install. Built for banking groups and regional holdings with several licensed entities: a subsidiary is read live from its own PQCA, or from a CBOM it uploads. Licensed per number of linked subsidiaries. This is federation — many separate installs reporting upward to a parent — not multi-tenant isolation inside one install.