A quantum-readiness score is useful only when you know what it can see
Black Kite has announced new third-party risk controls. Observable encryption signals are a starting point, not a complete security verdict.
If a supplier says it is ready for the quantum era, the obvious follow-up is: which systems, which cryptography and which evidence? A new rating feature turns that question into a product announcement, but it also exposes a useful limit on what a score can establish.
Black Kite announced Quantum Readiness controls on October 21. The company says they examine observable signals including hybrid post-quantum key exchange and certificate-signature readiness, with the controls incorporated into the SSL/TLS Strength category of its cyber rating. These are the supplier’s descriptions of its product, not an independent validation by QubitWire.[1]
The attraction is scale. A procurement or security team cannot begin every supplier review with a full audit of every connected system. Visible signals can help identify where further questions are worthwhile. But a useful signal is not the same thing as comprehensive coverage.
An externally visible service can be modern while an internal application remains unexamined. Conversely, a system may have a legitimate migration plan that cannot be inferred from one public endpoint. Our editorial assessment is that a rating should start a conversation about scope, evidence and ownership rather than end it.
NIST’s post-quantum programme recommends beginning migration and identifying where vulnerable algorithms are used. That is an inventory problem as well as an algorithm-selection problem. A programme needs to know what must change, who can change it and how replacement behaviour will be tested.[2]
None of this requires claiming that a machine capable of breaking today’s widely used public-key systems will arrive on a particular date. Nor does it mean post-quantum cryptography is a quantum network or that a website using one new protocol has become immune to all cyberattacks.
For a buyer, the practical test is simple: ask the rating provider exactly what it observes, which assets it cannot see, how often the evidence changes and how a disputed finding can be corrected. The most trustworthy readiness score is one whose limitations can be explained as clearly as its number.