Black Kite Adds Quantum Readiness Checks to Vendor Ratings
Black Kite has integrated Quantum Readiness controls into its third-party Cyber Rating platform. This enhancement provides customers with an external assessment of how their vendors are preparing for post-quantum cryptography.
The new feature connects the vendor rating company, the rated vendors, and the buyers who rely on these scores during procurement. This addition comes as government mandates are shifting post-quantum considerations from internal migration plans to supplier selection.
Details of the New Checks
Black Kite states that these controls are part of the SSL/TLS Strength category within its Cyber Rating. They analyze observable indicators of post-quantum readiness across a vendor’s ecosystem. The company outlines the following inputs and outputs:
- Detection of hybrid post-quantum key exchange on a vendor’s public-facing assets.
- Assessment of certificate signature readiness for the transition to post-quantum algorithms.
- Identification of assets without a defined migration path.
- A rating incorporated into the existing SSL/TLS Strength score, ensuring quantum agility is visible alongside other third-party risk indicators.
These checks measure what is externally visible from a vendor’s systems as opposed to internal operations. Black Kite presents the output as an early indicator of security maturity, enabling buyers to differentiate between vendors that are quantum-ready, those in transition, and those lagging behind.
Ferhat Dikbiyik, the company’s Chief Research and Intelligence Officer, emphasized that third-party risk management must consider future risks, not just current ones. The company links this launch to the “harvest now, decrypt later” threat, where attackers collect encrypted traffic today for future decryption.
Why Vendor PQC Posture Is Now a Procurement Issue
The timing aligns with fixed migration deadlines across several countries. Black Kite highlights NIST‘s timeline, which deprecates RSA, ECDSA, and ECDH after 2030 and prohibits them after 2035. Additionally, OMB M-26-15 and Executive Order 14412 initiate a federal acquisition rule that will affect covered contractors by December 31, 2030.
Germany’s BSI follows a similar schedule, with TR-02102-1 guidance phasing out classical-only key agreement around the turn of the decade. As sensitive data frequently moves through third parties, the least prepared supplier can become a vulnerability for everyone downstream.
What the scores do not yet address is how a single score accommodates vendors adhering to different national hybrid rules, or the refresh frequency of external signals. Black Kite has not disclosed its scoring weights, which would influence how buyers interpret moderate results.
For further information on vendor readiness and migration timelines, consult QNews coverage of post-quantum security.