// tool reference · Vulnerability & Assessment
PQC Migration Suite Pro
Org-wide crypto inventory, phased NIST migration, PQC compliance score and AI playbook.
What it does
Turns the PQC inventory into a sequenced migration plan: what to move first, what can wait, and where hybrid modes buy time.
When to use it
- You have the analysis and need a plan with an order and a rationale.
Inputs
Field names are the actual form parameters, verified against source.
| Field | Type | Required | Notes |
|---|---|---|---|
| asset_name | text | required | Asset identifier. |
| asset_content | textarea | optional | Asset detail. |
| asset_type | select | optional | Asset class. |
| action | hidden | optional | Operation. |
What you get back
A migration plan with sequencing and hybrid recommendations.
Worked example
Input
asset_name = customer-api asset_type = TLS endpoint
Output (abridged)
MIGRATION PLAN -- customer-api
PHASE 1 (now) Inventory + hybrid readiness
- Confirm the TLS terminator supports hybrid KEM.
- Shorten certificate lifetime to <=398 days.
PHASE 2 (next renewal) Hybrid key exchange
- X25519+ML-KEM-768. HYBRID, not pure -- it stays safe if either
algorithm is broken, which makes it the low-risk step.
PHASE 3 (when CA support lands) PQC signatures
- ML-DSA-65. Gated on your CA, so plan but do not block on it.
Sequencing rationale: key exchange FIRST, because it defends against
harvest-now-decrypt-later today. Signatures only matter at the moment
of authentication, so they can wait.
How it works
Deterministic inventory plus AI planning.
Limits
Read live from the platform configuration.
| Rate limit | 12 requests / hour |
Limitations — what it does not do
Planning output, not a migration. It cannot see your CA's roadmap or your load balancer's cipher support -- verify each phase against your actual stack.
Privacy
Asset data is sent to the AI provider.
Standards
NIST PQCNIST CSF