Why ACD
Deterministic, not guesswork.
Most PQC tools tell you something exists. ACD tells you what it is, whether it breaks, and exactly what replaces it — with evidence an auditor can re-run.
Deterministic, not LLM
Zero false positives on the critical path — classification is a registry lookup, not a guess. A security decision is only as good as its evidence.
Purpose-aware migration
Signature vs encryption is not the same migration. ACD maps each asset to the right post-quantum replacement.
Signed & reproducible
Findings carry signed, verifiable evidence — an auditor can re-run and confirm, not take your word for it.
Eleven surfaces
The full estate, not just TLS. Code, binaries, keys, certs, dependencies, runtime and more.
Comparison
Where ACD fits.
Spreadsheets, TLS scanners and agentic tools each miss the pieces a regulator actually asks for.
| Capability | ACD | Spreadsheet | TLS scanner | LLM tool |
|---|---|---|---|---|
| 11 crypto surfaces | ✓ | — | — | ◐ |
| Deterministic classification (no hallucination) | ✓ | — | — | — |
| Purpose-aware migration (sign vs encrypt) | ✓ | — | — | ◐ |
| Quantum verdict + Mosca risk per asset | ✓ | — | ✓ | ◐ |
| CycloneDX CBOM export | ✓ | — | — | — |
| Drift + continuous monitoring | ✓ | — | — | — |
| Signed, reproducible evidence | ✓ | — | — | — |
◐ = partial / unreliable (e.g. an LLM that "might" flag it, without deterministic evidence).
The moat
Signature is not encryption.
The mistake everyone makes is treating RSA as one problem. ACD splits it by purpose and maps each to the right standard.
Documentation
Why this approach is the right one.
ACD's method isn't an opinion — it follows the authoritative transition guidance.
NIST IR 8547 — Transition to Post-Quantum Cryptography Standards
Recommends an inventory first, then purpose-based algorithm replacement — the exact order ACD automates.
HKMA — Quantum Preparedness whitepaper (Jul 2026)
Names the cryptographic inventory the "longest lead-time item" — the step ACD collapses from months to days.
NIST FIPS 203 / 204
Why "purpose-aware" matters: the standard for key exchange (ML-KEM) is not the standard for signing (ML-DSA).