Boards and auditors increasingly ask for evidence of PQC readiness, not just a stated intention to migrate eventually. A self-reported questionnaire doesn’t hold up the same way a documented scan result does. Cipherscan gives risk and compliance teams a defensible, repeatable number to point to.
What does a Cipherscan report actually show?
A pass or fail status per scanned host, checked against whether the negotiated algorithm is ML-KEM (FIPS 203), ML-DSA (FIPS 204), or a classical algorithm those standards are meant to replace, plus one overall readiness percentage across all scanned hosts. See Reporting and Dashboard for the full report format.
What you get
Objective, repeatable evidence
A scan-based readiness percentage you can re-run and defend, not a one-time self-assessment.
Mapped to CNSA 2.0 and NIST PQC standards
Every pass or fail status checks against the currently approved algorithm list, so it stays audit-relevant.
A number leadership can track
One overall readiness percentage that’s easy to report upward and re-check on a schedule.
Is a Cipherscan readiness score the same as a compliance certification?
No. Cipherscan is a cryptographic posture assessment and PQC discovery tool, not a certifying body. “PQC ready” describes a scanned host’s negotiated algorithm, it isn’t a claim of certified compliance with CNSA 2.0, CMMC, or any other framework. Use it as the evidence base behind your own compliance review, not a substitute for one.
Get a real number before your next review.
Written by the team behind Anvil Secure.