How the model works

How Coldproof turns post-quantum change into a migration budget

From measured cryptographic performance to a financial model security and finance can use.

01 / Measure

Measure what actually changes.

Post-quantum cryptography changes more than an algorithm name. It can change operation time, handshake behavior, signatures and keys, certificate sizes, protocol overhead, throughput and the way infrastructure behaves under load.

Coldproof starts with measured evidence from PQC Arena rather than a generic performance assumption. The run, machine and software environment stay attached to the number so the evidence can be inspected.

PQC Arena / Measurement receipt2026-09-21 · 6ed429a
Hybrid TLS handshake248.1 µsMeasured on c7i.large
Per core
4,030
Wire delta
+2,272 B
Wire ratio
36.5×
Inspect the underlying protocol measurements

Measurement tells us what changed. It does not yet tell us what that change costs your organization.

02 / Map

Put those changes inside your estate.

A benchmark alone cannot price a specific organization’s transition. The same cryptographic change can land very differently in a payments gateway, an internal service mesh, a certificate authority or an embedded device fleet.

Coldproof maps measured effects onto the systems that create work and cost. Customer inputs may include certificate volumes, HSM footprint, application estate, connection volumes, infrastructure profile and migration timing. These are explicit inputs—not claims of fully automated estate discovery.

Where does a cryptographic change become an operational change?
Measured changePQC performance
and protocol effects
PKIHSMsCertificatesTLSAPIsApplicationsDatabasesIdentityNetworksIoTBlockchains
Evidence → estate context → operational effect
03 / Model

Turn infrastructure effects into money.

Measured effects and customer inputs feed a multi-year migration model. The model separates the transition project from the infrastructure and operating-cost differences that can remain after implementation.

Cost categories
  • Discovery and inventory
  • Application remediation
  • PKI transition
  • HSM refresh
  • Infrastructure changes
  • Testing and validation
  • Parallel classical/PQC operation
  • Recurring operating-cost differences
Decision outputs
  • Low / Base / High scenarios
  • Annual migration spend
  • CapEx / OpEx
  • Recurring infrastructure delta
  • Cash-flow profile
  • NPV
  • Sensitivity analysis
  • Threshold-driven cost changes
ProvenanceMeasuredCustomer suppliedPublic defaultBounded estimate
Coldproof / Financial model / v1.4Post-Quantum Migration Workbook
Base case / USD M
7-year undiscounted$18.4M
NPV of migration cost$15.8M
One-time migration spend$8.1M
Recurring infra delta$1.47M/yr
Peak annual spend2029 / $4.2M
Parallel operation18 months
1Migration spend scheduleAnnual cash flow / USD millions
Cost category2027202820292030203120322033Total
Discovery / inventory.45.35.201.00
PKI transition.10.40.70.70.40.25.152.70
HSM refresh.10.25.45.50.30.15.051.80
Application remediation.10.501.101.601.451.05.606.40
Network / infrastructure.05.20.35.45.40.35.302.10
Validation / testing.05.15.30.40.35.30.151.70
Parallel classical + PQC.15.40.65.70.50.302.70
Total CapEx.35.751.351.551.05.70.456.20
Total OpEx.451.252.052.652.651.851.3012.20
Annual cash flow.802.003.404.203.702.551.7518.40
2Core assumptionsHighlighted cells are editable model inputs
Discount rate 8.5%Migration duration 7 yearsApp remediation $34.4K / appHSM replacement rate 64%Migration start Q2 2027Applications 186
SummaryAssumptionsMigration SchedulePKI + HSMApplicationsSensitivity
Illustrative model output — not a customer estimate
04 / Decide

Give security and finance the same number.

The purpose is a decision-ready migration view, not another technical report. Security can see what drives the estimate; finance can see when cash is required, what remains uncertain and which assumptions deserve another measurement.

  1. 01How much should we budget?
  2. 02When will the largest costs occur?
  3. 03Which assumptions change the answer most?
  4. 04Where could infrastructure capacity force a step-change in cost?
  5. 05What should we measure next before committing the budget?
Post-Quantum Migration BudgetExecutive decision brief / Base case
Recommended planning case$18.4M

Seven-year undiscounted migration cost

7-year NPV$15.8M
Peak spend2029 / $4.2M
Largest driverApplication remediation
Parallel operation18 months
Low $12.9MBase $18.4MHigh $27.2M
Confidence72%
Top sensitivities

Application scope · Migration duration · HSM refresh timing

Measured inputsCustomer assumptionsConfidence bounds

Illustrative output — not a customer estimate

Migration model

Know what your migration could cost.

We’re working with a small number of organizations to model the economics of their post-quantum transition.

Request a migration model

Know the cost of post-quantum migration.

Coldproof