PQC Readiness War Room

TLS Modernization

STRONG

Browser-to-edge score: 80/100

PQC Verification

NOT VERIFIED

Score: 0/100
PQC support is not directly verified from this Worker alone.

PQC Migration Readiness

MEDIUM

Score: 50/100
Some modernization signals are present, but important target or inventory evidence is still missing.

Crypto-Agility Status

NOT ASSESSED

No score is assigned until discovery, inventory, governance, vendor readiness, and migration planning evidence are assessed.

Executive Summary

Transport posture is strong.

PQC support is not verified.

Migration readiness is medium because crypto discovery is not assessed.

Next action: collect endpoint, certificate, vendor, and application crypto evidence.

This summary explains the posture model without converting unknown signals into verified readiness.

Executive Brief

Scope

Browser-to-edge metadata and public HTTPS response headers.

Targets

Primary:No primary target selected

Compared:None

Summary

Transport posture is strong. PQC support is not verified. Migration readiness is medium because crypto discovery is not assessed. No target assessment has been run.

Top Observed Signals

TLS 1.3 observed on the browser-to-edge connection
HTTP/2 observed on the browser-to-edge connection
AEAD-like cipher observed on the browser-to-edge connection

Top Unknowns

ML-KEM support
Hybrid PQC support
ECH support
Crypto inventory coverage
Organizational crypto-agility

Recommended Next Action

Collect endpoint, certificate, vendor, and application crypto evidence.

Key Takeaway

A modern TLS posture is a prerequisite for PQC migration, but it is not proof of PQC readiness.

This brief is generated from the same observed, derived, unknown, not verified, and not assessed signals shown elsewhere on the dashboard.

Evidence Ledger

Signal

Source

Result

Confidence

Browser HTTP protocol

request.cf.httpProtocol

HTTP/2

Observed

Browser TLS version

request.cf.tlsVersion

TLSv1.3

Observed

Browser TLS cipher

request.cf.tlsCipher

AEAD-AES256-GCM-SHA384

Observed

TLS modernization posture

derived from browser-to-edge metadata

STRONG

Derived

Target HTTPS reachable

target fetch

Not run

Target HTTP status

target fetch response

Not run

Target HTTP/3 advertisement

Alt-Svc response header

Not run

Target HSTS

Strict-Transport-Security response header

Not run

PQC migration readiness

derived posture model

MEDIUM

Derived

ML-KEM support

not measured by this Worker

Unknown

Not verified

Hybrid PQC support

not measured by this Worker

Unknown

Not verified

ECH support

not measured by this Worker

Unknown

Not verified

Crypto inventory coverage

not assessed by this Worker

Unknown

Not assessed

Organizational crypto-agility

not assessed by this Worker

Unknown

Not assessed

Observed rows come from Worker request metadata or target response headers. Derived rows come from this posture model. Unknown, not verified, and not assessed rows are intentionally not treated as proof.

Target HTTPS Posture Assessment

NO TARGET

Enter a public domain to run a lightweight HTTPS posture assessment.

This target assessment checks HTTPS reachability and selected response headers. It does not enumerate TLS key exchange groups or verify PQC support.

Observed Browser-to-Edge Connection

TLS:TLSv1.3

HTTP:HTTP/2

Cipher:AEAD-AES256-GCM-SHA384

Edge:CMH

Visibility:HTTP/2 over TLS provides a familiar TCP-based enterprise visibility posture.

Protocol Intelligence

Protocol:HTTP/2

Interpretation:TCP-based encrypted transport

Why It Matters

HTTP/2 remains easier to reason about with traditional TCP-centric network tooling, but payload remains encrypted.

Operational Impact

Use flow metadata, endpoint telemetry, application logs, and authorized inspection where justified.

Recommended Telemetry

Flow metadata, endpoint telemetry, application logs, authorized inspection where justified.

Modernization Signals

TLS 1.3: Observed HTTP: HTTP/2 AEAD Cipher: Likely ECH: Unknown from Worker context PQC Verified: Not from Worker alone

Location and Network Context

Country:US

City:Columbus

Region:Ohio

ASN:16509

AS Org:Anthropic, PBC

Crypto-Agility Assessment

DiscoveryUNKNOWN

InventoryUNKNOWN

GovernanceUNKNOWN

Vendor ReadinessUNKNOWN

Migration PlanningUNKNOWN

Organizational crypto-agility requires discovery, inventory, ownership, and migration planning inputs.

Crypto Discovery

NOT ASSESSED

Discovery evidence is required before a migration plan can be trusted. This Worker does not perform endpoint inventory, source analysis, uploads, or database-backed discovery.

Required Evidence

□ TLS endpoint inventory

□ certificate inventory

□ application crypto dependencies

□ vendor crypto dependencies

□ code and library crypto usage

□ data-at-rest encryption dependencies

□ key and certificate ownership

Current Tool Coverage

✓ browser-to-edge TLS metadata

✓ HTTPS posture signals for a public target

✓ selected response headers

✓ Alt-Svc advertisements

Not Covered

? internal systems

? source code crypto usage

? embedded keys or certificates

? vendor product crypto

? data-at-rest crypto

? complete key ownership and rotation evidence

PQC Readiness Analysis

Observed Modernization Evidence

✓ TLS 1.3 observed on the browser-to-edge connection

✓ AEAD-like cipher observed on the browser-to-edge connection

✓ Modern HTTP protocol observed on the browser-to-edge connection

Readiness Gaps

□ No target HTTPS posture assessment has been run

Unknown Signals

? ML-KEM support not proven

? Hybrid PQC key exchange support not proven

? ECH support not proven

? Cryptographic inventory coverage not proven

? Organizational crypto-agility not proven

This analysis estimates migration preparedness from observable posture signals. It does not verify PQC support or enumerate TLS key exchange groups.

Readiness Findings

PASS TLS 1.3 observed

The browser-to-edge connection is using TLS 1.3.

PASS Modern HTTP protocol observed

HTTP/2 was observed between browser and edge.

PASS AEAD cipher observed

Observed cipher appears to use modern authenticated encryption.

PASS No legacy TLS observed

No TLS 1.0, 1.1, or 1.2 signal was observed for this request.

INFO ECH planning required

ECH status is not directly provable from this Worker context.

INFO PQC support not directly verified

This Worker cannot prove PQC or hybrid KEM support by itself.

Recommendation

Strong TLS modernization posture. Next step: inventory cryptographic dependencies, validate vendor PQC roadmaps, and map visibility requirements.

Practical next step: inventory TLS endpoints, map crypto dependencies, validate vendor PQC roadmaps, and define visibility requirements before migration.

Validation Plan

Priority 1

□ Confirm TLS endpoint inventory

□ Validate certificate inventory

□ Check vendor PQC roadmap

Priority 2

□ Identify application crypto dependencies

□ Map visibility requirements for HTTP/3

□ Define ownership for migration planning

Do Not Infer

? ML-KEM support

? hybrid PQC support

? ECH support

? crypto-agility maturity

Use this plan to move from posture observations to evidence collection without treating unknown signals as verified.

Platform Roadmap

✓ Phase 1: TLS Modernization

✓ Phase 2: HTTPS Posture Assessment

✓ Phase 3: PQC Readiness Analysis

✓ Phase 4: Crypto Discovery Evidence Model

✓ Phase 5: Validation Plan

✓ Phase 6: Evidence Ledger

✓ Phase 7: Target Comparison Mode

✓ Phase 8: Executive Brief Mode

□ Phase 9: Migration Planning

What This Cannot Prove Alone

It cannot fully enumerate supported TLS key exchange groups.
It cannot prove PQC or hybrid KEM support by itself.
It cannot determine full enterprise crypto inventory.
It cannot replace active scanning, endpoint inventory, vendor validation, or governance assessment.

Executive Takeaway

A modern TLS posture is a prerequisite for PQC migration, but it is not proof of PQC readiness. True readiness requires cryptographic discovery, inventory, governance, vendor validation, and migration planning.