The RelixQ Score and the three dashboards

The RelixQ Score is a deterministic, explainable, versioned, auditable, coverage-aware 0–100 measure of post-quantum migration readiness across the scanned surface. Higher is better. A score of 100 means no detected quantum-vulnerable cryptography remains active in what RelixQ has actually scanned; a score near 0 means the scanned surface is dominated by active, high-severity quantum-vulnerable cryptography.

Deterministic

The same finding set and the same formula version always produce the same score. No randomness, no time-of-day drift.

Explainable

The gap between your score and 100 reconciles to a ranked list of drivers you can click through to the underlying findings.

Coverage-aware

The score never claims to measure cryptography it has not seen. It always travels with coverage context — services scanned, confidence, last scan — so a good number on thin coverage cannot masquerade as a good number on full coverage.

Some surfaces — project cards on the org home, the trend chart legend — use a coarser green / amber / red health colouring for at-a-glance reading. That colouring is presentation only. The five bands are the contract, and the number itself always wins.

When you open a dashboard for a project before its first scan completes, the score hero says exactly that and offers a link to run a scan. On the org home, unscanned projects show an "n/a" ring and a "Not scanned" label instead of a score.

The Engineering and Executive dashboards share the same score hero card. Six elements, each doing a specific job:

• Gauge, band pill, and 30-day delta. The 0–100 ring, the band label, and whether the score moved up, down, or stayed flat.
• What is moving the score. Ranked drivers with estimated point impacts — critical findings, high findings, unowned findings, quantum-vulnerable findings, and, when QAST has run, HNDL-critical exposures. Each driver deep-links to the matching filtered findings view.
• Next best actions. A short, ranked to-do list with an estimated score uplift per action. Uplifts are estimates, not guarantees.
• Coverage chips. Open findings, services covered, languages observed, detector confidence, and last-scan time.
• Signals row. Per-signal transparency chips marked live, partial, or not wired. If a signal is not feeding the score yet, the hero says so on its face.
• Methodology footnote. States the estimate nature of point impacts and the current coverage limits.

When the Quantum Exposure Assessment layer has run, HNDL-critical exposures — confidential data flows where the harvest-now-decrypt-later window is open and the cryptography in the path is quantum-vulnerable — appear as a first-class, heavily weighted score driver, capped at 25 points of impact. They surface with their Mosca X + Y > Z explanation and a matching "close HNDL exposure" next-best action.

• Static-code analysis only, today. The v1 score reflects findings from static code scanning. Dependency, cloud posture, and runtime signals are not yet folded into the number — the hero footnote and signals row state this explicitly.
• Point impacts are estimates. Driver impacts distribute the gap to 100 across open findings; they are v1 estimates, not exact decompositions.
• Approved exceptions raise the score without migrating anything. RelixQ surfaces exception-driven lift as accepted risk, distinct from genuine migration progress — check the Security dashboard exceptions widgets before treating an improvement as remediation.

The RelixQ Score answers "how exposed am I?". The Crypto-Agility Scorecard answers a different and complementary question: how mechanically expensive is it to change?

Two systems with identical findings can have wildly different migration costs. One wraps cryptography behind a single provider interface; the other hard-codes RSA2048 at 400 call sites. The scorecard quantifies this as a 0–100 score per repository or service, so you can prioritize the refactoring that makes every future migration cheaper.

Available at GET /api/v1/scores/projects/{projectId}/agility, and from the local engine with the -agility flag.

Route: /orgs/<slug>. For anyone entering the product; the fastest cross-project read.

• Rollup strip. Projects (count), At risk (assessed projects in the red zone), Open findings (summed), and Avg RelixQ score (average of assessed projects only; a dash until at least one is assessed).
• Project cards. A score ring or "n/a" if not yet scanned, open and critical counts, time since the last scan, and a health band strip.
• Empty state. A brand-new org shows no fabricated data — just a prompt to create your first project.

Route: .../dashboard/engineering. For engineers and tech leads driving remediation day to day. The header shows a live "Scan running" indicator with the partial finding count whenever a scan is in flight.

The PQC readiness card breaks the project unresolved findings down by what fixing them actually implies. Four rows, each a drill-down into the filtered findings list:

The headline reads Needs migration → Review required → Classical remediation → No PQC migration findings → No findings, in that priority order, so a present-day classical break is never reported as a clean bill of health. The card is explicit that it is an inventory summary, not proof that the project is quantum-safe.

Three breakdown cards follow, each with an expandable disclosure table: by Service (route work to owning teams), by Algorithm (plan shared fixes — one library swap often clears a whole slice), and by Language (match remediation to the teams fluent in each stack). Each shows an honest empty message rather than a fake chart when its dimension has no data.

Route: .../dashboard/executive, optionally with ?trend=30d|90d|1y (default 90d). For executives and security leadership who need a trend line and a shareable snapshot, not a work queue.

• Header actions. A freshness stamp, the active reporting window, a copy-link button (the window is in the URL, so the link reproduces exactly what you are looking at), and Export report.
• KPI row. Critical findings, Total findings, Open findings with a score-history sparkline, and the reporting period itself — so a screenshot is self-describing.
• RelixQ Score trend. A full-width daily chart with a 30d / 90d / 1y toggle, the current score and 30-day delta, and a band legend. The chart carries its own caveat inline: static-code analysis only, rescored daily.
• Open findings by severity. The critical / high / medium / low split of what remains.
• Quantum exposure. Open quantum-vulnerable findings, externally exposed count, algorithm spread, and a migrate deep-link straight to the filtered findings list.

For board use, quote the score with its band and coverage context — "72, In Progress, static-code coverage across N services" — not the bare number.

Route: .../dashboard/security. For security engineers and GRC owners tracking enforcement, accepted risk, and external exposure.

• Policy violations — aggregated policy decisions: block, require-review, warn, allow.
• Exceptions — the current list with status and expiry. Because approved exceptions lift the score, this is the honest counterweight to a rising number.
• External TLS exposure — a per-endpoint table of externally visible posture. See TLS posture.
• Audit timeline — recent governance activity.