PQC key exchange
The probe records whether the tested public TLS path exposes the hybrid X25519MLKEM768 signal. If the probe runtime cannot offer the group, the result is Not tested, not a failure.
Q-READY METHODOLOGY
Measured evidence, with the limits left visible.
Q-Ready is a point-in-time, public-edge observation tool. It separates quantum-readiness evidence from general web-security signals so a certificate label does not become an alarm by itself.
THE REPORT RULEUnknown is not the same as failed.
When a probe cannot verify a signal, the report says Not tested and explains what evidence is needed next.
01 · QUANTUM READINESS
What the first report observes.
The quantum section focuses on public TLS signals that help an owner start a migration conversation. It does not claim that a private estate, every client path or every stored dataset is safe.
TLS protocol posture
TLS 1.3 is treated as the preferred public baseline. TLS 1.2 compatibility is reported as context and is not treated as a quantum finding by itself.
Certificate evidence
Issuer, algorithm and expiry are recorded for the observed chain. A classical certificate is shown as Informational, not as proof that the endpoint is quantum-vulnerable.
Endpoint reachability
The report records whether HTTPS responded on the standard public port at the time of the check.
02 · GENERAL SECURITY BASELINE
A separate view for selected public controls.
The general security score is deliberately separate from the quantum evidence. It is a compact passive baseline, not a vulnerability scan or penetration test.
Transport and browser controls
The separate baseline checks selected visible signals such as HSTS, CSP, framing protection, MIME sniffing protection and referrer policy.
Cookie attributes
Visible cookies are checked for Secure, HttpOnly and SameSite attributes. Cookie values are not displayed in the report.
Mixed content and banners
The first HTML response is checked for HTTP asset references and unnecessary server or framework disclosure.
03 · INTERPRETATION
How to read a result.
Pass means the selected public signal was observed. Action recommended means the signal needs an owner and a follow-up. Informational means the observation is useful context but is not scored as a failure. Not tested means the probe could not verify the control.
The numeric security baseline starts at 100 and subtracts 25 for each high, 12 for each medium and 5 for each low finding. Informational findings subtract nothing. This is a planning index for the selected passive checks; it is not a universal security grade.
The quantum section is interpreted through evidence rows rather than a claim that a classical public certificate is “quantum-vulnerable”. The most useful present-day public signal is hybrid key exchange, followed by protocol posture, ownership and provider evidence.
BOUNDARY
Q-Ready does not authenticate, exploit, fuzz, bypass controls, enumerate private services or inspect application data. Run checks only against endpoints you own or are expressly authorized to test.
04 · REFERENCE POINTS
Standards and guidance to keep beside the report.
These references are starting points for a security or cryptography owner. They do not turn a Q-Ready result into certification or compliance advice.
NIST FIPS 203Module-Lattice-Based Key-Encapsulation Mechanism StandardOpen reference ↗NIST FIPS 204Module-Lattice-Based Digital Signature StandardOpen reference ↗NIST FIPS 205Stateless Hash-Based Digital Signature StandardOpen reference ↗Singapore CSAQuantum-Safe Migration Handbook and Quantum Readiness IndexOpen reference ↗
NEXT STEP
Run one authorized public check.
Use the report to identify the owner, ask the provider for dated evidence and choose a reversible next action.