Risk & Strategy / Cost Model Explorer
§5What this is for: Compare the six PQC costing-model families on one scenario, with a live Monte Carlo run.
What a good answer looks like: A range, not a point. The honest output of this tool is the spread between your best and worst assumptions, and which assumption drives it.
Worked example: Enter the systems in scope and the annual IT budget, then compare the parametric, bottom-up and Monte Carlo estimates: the spread between them is your honest range, and the driver that moves it most is the assumption to defend.
Runtime and privacy: This planning tool runs in your browser. Use synthetic or approved organizational data and review the site privacy terms before entering sensitive material.
For your role
- Executive / Business Leader
- Enter the systems in scope and the annual IT budget, then read the parametric, bottom-up and Monte Carlo estimates side by side: the spread between them is the honest range to bring to a budget discussion.
- GRC / Risk & Compliance
- Run Monte Carlo and note which slider moves the result most: that assumption is the one to document and defend, and the cost-of-inaction line is shown as a reference because it measures a different thing.
Feel the difference. One scenario, six lenses. Five estimate the cost of migrating; the sixth (cost of inaction) is shown as a reference line, because it measures a different thing. Every figure is illustrative and driven by the sliders below — the lesson is how far the methods diverge.
8% of IT budget × 5yr — ignores system count entirely, and is the lens most sensitive to programme duration.
$40K/system × complexity × 250 + $3.3M standing program cost over 5yr.
Samples an uncertain per-system cost → P10–P90 band. A range, not a point.
Optimistic / expected / conservative around the bottom-up number.
$30K/system from past crypto migrations × 250 + $3.3M standing program cost (illustrative).
On this scenario the five migration-cost methods range from $10.8M to $20.0M — a 1.8× spread on identical inputs. No single number is “the” cost; that is exactly why you estimate more than one way and reconcile.
How the spread is built: all five lenses estimate the same quantity — the total cost of this programme — so all five respond to the planning horizon. Per-system work does not stretch with the schedule, but standing programme costs (PMO, governance, discovery) accrue for as long as the programme runs, so those scale while the per-system term does not. The parametric lens remains the most horizon-sensitive by construction, since it is a share of annual budget spent every year. The cost-of-inaction marker is a different quantity and is deliberately kept off the migration-cost comparison.
Monte Carlo, run live
The probabilistic lens doesn't give a number — it gives a distribution. Run it and watch 1,000 draws build the shape. Each draw samples an uncertain average cost-per-system; the band is where the middle 80% lands (P10–P90).
Next, the ROI Calculator builds a defensible bottom-up estimate for your own estate and cross-checks it against your assessment — one honest number you can take to the board, with the humility this explorer just demonstrated.
Cost Model Comparison — Export
Export the comparison as markdown, PDF, or DOCX — also saved to your Command Center Risk Artifacts.
Illustrative simulation for building intuition. Figures derive from the sliders above and the labelled constants in each method — not from your organization's data.
- /assess — compliance frameworks step— Step 5 captures policy + framework registry
- /compliance — framework explorer
- /leaders — stakeholder ecosystem
- /library — policy & governance docs
- NIST CSWP.39-upd1 — Considerations for Achieving Crypto Agility (Dec 2025, upd. Jun 2026)
- NIST IR 8547 — Transition to PQC Standards
- ENISA — Post-Quantum Cryptography Integration Study
- NIST Computer Security Resource Center (Americas)
- NIST News & Events (Americas)
- NSA Media Defense Portal (Americas)
- CISA Quantum Page (Americas)
- BSI Post-Quantum Cryptography (EMEA)
- ANSSI Cryptography Guidelines (EMEA)
Try it
After Run Monte Carlo, what is the honest number to bring to a budget discussion?
Next step
Next in Risk & Strategy: CRQC Scenario PlannerCRQC Scenario Planner is the next Risk & Strategy tool in the Command Center.