The Problem
"Harvest now, decrypt later" means adversaries can capture encrypted traffic today and read it the day quantum computers arrive. Long-lived certificates protecting sensitive data are already at risk — yet almost no organization has an inventory of its quantum-vulnerable crypto, let alone a migration order.
What It Does
Heimdall classifies every certificate in your estate by quantum risk — RSA, ECC, and DSA are all broken by Shor's algorithm, and key length is irrelevant — then ranks your harvest-now-decrypt-later exposure by certificate lifetime and asset criticality. It analyzes transport crypto, scores crypto-agility, correlates crown-jewel assets, and exports a migration roadmap framed to the CNSA 2.0 timeline.
Key Capabilities
- Certificate quantum-risk inventory — classifies every cert by algorithm family; RSA/ECC/DSA are all Shor-breakable regardless of key length.
- Harvest-now hit-list — crosses cert lifetime against asset criticality to surface long-lived certs on high-value assets to fix first.
- Transport-crypto analysis — inspects TLS/SSH key exchange plus weak-MAC signals (including SHA-1).
- Crypto-agility tiers — scores each host PQC-ready, Upgradable, or Legacy from its OpenSSH/OpenSSL footprint.
- Crown-jewel correlation + priority score — folds calibrated ACR into one migration priority.
- CSV migration roadmap + gated "PQC" tags — exports the plan framed to CNSA 2.0.
How It Works
Runs against the local navi.db built from your Tenable data: the certs table, transport/cipher plugins, and software inventory for OpenSSH/OpenSSL readiness. All writes are proposed, human-approved, and logged.
Who It's For
PKI and crypto owners planning the PQC migration; CISOs and compliance planners working the CNSA 2.0 timeline; GRC teams that need evidence, not estimates.
Proof Points
In a 268-asset reference environment, Heimdall found ~100% of certificates quantum-vulnerable — including certs valid to 2070 and 2114 — plus 110 TLS services offering no post-quantum ciphers, 79 TLS and 49 SSH services on classical-only key exchange, and 59 services still using SHA-1 MACs. Illustrative demo-lab results.
Works Better With
Consumes Certania's certificate inventory, Anubis's calibrated criticality, and Laelaps's KEV signal — so the migration roadmap reflects what's truly critical and actively exploited.