A one-minute read of your public-facing encryption.
This check looks only at what the internet can already see: the TLS on your website, the transport encryption on your email, and the DNS policies around both. It touches nothing internal and stores nothing sensitive.
It answers one narrow question: is the key exchange protecting traffic to you today post-quantum hybrid, classical, or older than that. That is the outer edge of the picture, not the whole of it.
- Reading DNS: addresses, mail exchangers, mail policies
- Negotiating TLS with the website and testing post-quantum key exchange
- Opening STARTTLS with the mail exchangers
- Writing the result
Website
| Check | Observed | Reading |
|---|
Email transport
| Check | Observed | Reading |
|---|
DNS and mail policy
| Check | Observed | Reading |
|---|
What this does and does not tell you.
Hybrid post-quantum key exchange at the edge protects traffic in transit from being harvested today and decrypted later. It says nothing about data already at rest, about signatures and certificates (no public CA issues post-quantum certificates yet), about internal systems, VPNs, APIs on other hosts, or about your suppliers. Those are where most of the actual decisions sit.
If the reading shows classical-only key exchange, that is normal in 2026 and often fixed by a CDN or web-server setting. Whether it matters depends on how long the data crossing that connection needs to stay secret.
If you want the inside picture
A readiness snapshot takes this from the outer edge to the systems and datasets that actually carry long-lived risk, benchmarked against NZISM, with a defensible order of what to move, what to leave, and what to watch.