0xA4F2
0x3C8B
0xDE1F

Risk Teams · Financial Institutions · Regulators

Third-Party Cryptographic
Exposure Model

A Monte Carlo counterparty-risk framework adapted to the quantum-cryptographic threat. Quantify harvest-now-decrypt-later exposure, authentication integrity risk, and regulatory fine accrual across a 12-node payment network. Two clocks, three loss channels, 20,000 simulated paths.

Risk Teams · Financial Institutions · Regulators
Model Parameters

Adjust the systemic assumptions. All charts update live.

2032
50/50 point for quantum computing readiness
0.35
Log-space spread — higher = fatter tails
0.40
Shared-vendor / deadline correlation
0
− accelerates network, + delays
4.0%
Present-value rate for future losses
1.0×
Resize network dollar figures
Regulatory Deadline

The two-clock model: exposure accrues on both Q-day and the regulatory timeline.

Third-Party Providers DEMO DATA

Edit any cell to calibrate to your network. Exiting demo mode unlocks personalised results.

Provider Type Conf Rate ($M/yr) Auth Rate ($M/yr) Planned Migration Slip σ Shelf Life (yr) Laggard Prob
Card Network
Messaging
Card Network
Custodian
Custodian
Custodian
Processor
Processor
Processor
PKI / CA
PKI / CA
PKI / CA
⚠
Using illustrative data These figures are based on benchmark estimates. Edit any provider value in the table above to model your own network.
CryptoVA
--
Expected discounted loss
DEMO
99% VaR
--
Systemic tail loss
DEMO
99.9% VaR
--
Economic-capital tail
DEMO
% Migrated by Q-Day
--
Value-weighted coverage
DEMO
Diversification Premium
--
Independent view understatement
DEMO
Ecosystem Exposure Profile
Loss if Q-day fell in a given year (PFE curve). Mean with 97.5% / 99% tail bands.
Loss by Channel
Mean exposure split: HNDL confidentiality, authentication integrity, and regulatory fines.
Diversification Illusion
99% VaR: systemic shared-Q-day view vs the diversified (independent) assumption.
Q-Day Arrival Distribution
The lognormal distribution of quantum computing readiness. This is the model's deepest uncertainty.
Third-Party Exposure Ranking

Expected loss per provider (over Q-day distribution). Ranked by total exposure — your migration prioritisation view.

Rank Provider Type Conf. ($M) Auth. ($M) Reg. ($M) Total ($M)
Computing…
In Plain English ▾

One day, a quantum computer powerful enough to break today's payment security codes will exist. Nobody knows exactly when. This tool estimates how much money is at risk across a payment ecosystem before everyone is protected.

Two separate dangers

Harvest-Now-Decrypt-Later (HNDL). An attacker can copy encrypted data today and decrypt it after Q-day. Data with a long shelf life — settlement records, identity details — remains at risk for years. Data that expires quickly, like card numbers, becomes safe once it's stale.

Fake signatures. From Q-day until a provider completes migration, its digital signatures are forgeable. This is a forward-accruing risk: it starts at Q-day and accumulates until each provider is protected.

Why diversification fails here

In traditional credit risk, spreading exposure across many counterparties reduces tail risk. Quantum-crypto risk breaks this assumption. One quantum computer breaks every provider's legacy cryptography on the same day. Shared vendors, common certificate authorities, and a single regulatory deadline mean that when providers fall behind, they fall behind together. The "diversification illusion" chart shows exactly how much this assumption overstates safety.

The regulatory clock

Regulatory deadlines (DORA, US EO 14412, NCSC UK) add a third exposure channel. Providers that fail to migrate before the deadline face annual fines proportional to their authentication value at stake. This model runs both clocks — Q-day and regulatory — simultaneously.

Quantum Security and Defence does not collect, associate, or retain your name or your company name when you use these tools. All information is stored only for the duration of the browser session.

We collect only country, industry, and results data. This information is anonymised and cannot be associated with you or your company. Such anonymised data may be used for industry-level reporting, shared with members, incorporated into our research, and provided to government departments to support lobbying activity and the communication of industry readiness.

By using this tool, you consent to the provision of results data on a strictly anonymised basis. No personal name, email address, or company name is stored.