Govern cryptographic change before it becomes operational disruption.
The hard part isn’t choosing an algorithm. It’s knowing what you use, where it sits, who owns it, and how to change it without breaking the business.
CipherWyze gives you one record of your cryptography, the governance to decide what happens to it, and the programmes that carry out the change.
One record of your cryptography, governed, and changed through programmes.
The record
Navigator holds every certificate, key, algorithm, protocol and library in one inventory, with its owner, its business context and the decisions taken on it. It takes CycloneDX CBOMs from Discovery or from the scanners you already run.
The governance
Scope, inclusion, review states, exceptions and evidence sit on that record. Each decision carries a named person, a reason and a date, and a later scan cannot overwrite it.
The programmes
Post-quantum migration, TLS modernisation, certificate governance, weak cryptography remediation and inventory uplift run on the record as programmes, with phases, owned actions and gates. Each change closes with evidence.
Post-quantum migration is the most pressing programme today. The same record and the same governance carry every cryptographic change that follows it.
Scanners tell you what cryptography you have. CipherWyze governs what you do about it.
Cryptographic change reaches across the estate: identities, certificates, protocols, APIs, cloud infrastructure, delivery pipelines, suppliers, operational technology, embedded systems and long-lived data. Three mechanisms keep the record trustworthy across all of it.
When someone records an owner, a criticality, an exposure or a readiness status, that judgement is held. Later scans keep adding observations, but they do not overwrite the organisation’s position on assets it has already governed. That is the difference between a scan output and a system of record, and it is enforced in the data model rather than by convention.
Scope determines which assets are eligible for a programme. A named person decides which are actually included, and removing one requires a recorded reason. Every governed number, including every figure that reaches a board pack, is drawn from the included set. Scope cannot widen quietly between one report and the next.
Completing a remediation action requires either attached evidence or a recorded exception with a written justification. A programme gate can be passed while readiness is poor, but the decision is attributable, carries a rationale, and freezes the readiness position exactly as it stood when the call was made.
- FoundRSA-2048 certificate on the payments APIDiscovery scan
- OwnedOwner: payments platform teamAssigned by security architecture
- IncludedIn scope for PQC migrationInclusion reason recorded
- ExceptedRisk accepted until 30 June 2027Approved by the CISO
- RemediatedCertificate re-issuedChange ticket attached as evidence
- ReportedClosed in the quarterly board reportSigned Ed25519 and ML-DSA-65
Attribution is the common thread. Every governance state in the platform traces to a named person, a recorded rationale and a timestamp. The machine computes; it does not decide.
Programmes and registers on one record.
Every programme and register below runs on the same inventory, the same governance and the same evidence model.
Programmes
Plan, govern and evidence the move to post-quantum algorithms, phase by phase.
Ownership, review state and evidence for every certificate, whatever performs the renewal.
Protocol and configuration changes across the estate, each closed with evidence or a recorded exception.
Build out the cryptographic inventory, with an owner and business context for every asset.
Deprecated algorithms, short keys and old protocol versions, each with an owner and a path to closure.
Registers and reporting
Accepted risk with a named approver, a reason and a date it comes up for review.
Each supplier’s post-quantum position, the evidence behind it, and the systems that depend on it.
Board and audit reports as reproducible snapshots, signed with Ed25519 and ML-DSA-65.
- CycloneDX CBOM, in and out
- NIST FIPS 203, 204 and 205
- Ed25519 and ML-DSA-65 report signatures
- FINMA Guidance 05/2026
- DORA
- NIS2
- PCI DSS
The report that goes to your board is signed. Twice.
Navigator signs every governance report it issues with two signatures: Ed25519, and ML-DSA-65, the post-quantum signature standard NIST published in 2024. Any alteration to a published report is detectable, and the key that issued it is provable.
We did it that way for the same reason we would advise you to: during a transition you carry both, so today’s verification tooling can read the classical signature while the post-quantum one protects the record’s integrity into the period the transition exists to prepare for.
Cryptographic transitions fail operationally before they fail mathematically.
The PQC Reality Curve™ follows nine stages of perceived urgency in the post-quantum transition. The default path and the governed path diverge at stage five: one peaks in migration panic, the other reaches crypto-agility as an embedded capability.
The same programme, started late, runs in a shorter window.
A post-quantum transition moves through the same seven phases whenever it starts, from inventory and discovery to continuous governance. Started now, the work spreads across the years to 2035, with time to plan, test and coordinate with vendors. Started late, the same work is compressed into fewer years, at higher cost and with less room for testing and change.
Delivered with specialist partners.
Specialist partners deliver the advisory, transformation and operational work. Navigator is the platform and system of record their programmes run on.
- Regional delivery partners
- Cryptographic advisory services
- Transition programme governance
- Inventory and discovery integration
- Ongoing operational support