GET /pqc/scenarios

{
  "status": "success",
  "scenarios": [
    {
      "id": "bank-tls-inventory",
      "title": "Regional bank TLS inventory",
      "summary": "Board mandate to inventory RSA/ECDSA exposure across customer-facing TLS before 2030 NIST deadlines.",
      "target": {
        "domain": "api.regionalbank.example",
        "ports": [
          443,
          8443
        ],
        "persona": "CISO, regional bank",
        "organization": "Regional Bank Holdings",
        "mandate": "NSM-10 / NIST IR 8547 PQC migration program"
      },
      "manualBaseline": {
        "inventoryWeeks": 8,
        "assetsFound": 42,
        "quantumVulnerable": 38,
        "readinessScore": 18,
        "summary": "Spreadsheet inventory from Q1 is already stale; shadow APIs were missed."
      },
      "fixtureAssetIds": [
        "tls-api-bank",
        "tls-auth-bank",
        "jwks-oidc",
        "ssh-bastion",
        "email-mx",
        "code-sign-legacy",
        "discovery-ct-api"
      ]
    },
    {
      "id": "gov-contractor-cmmc",
      "title": "Gov contractor CMMC readiness",
      "summary": "FedRAMP/CMMC assessor requires cryptographic inventory with remediation backlog before contract renewal.",
      "target": {
        "domain": "portal.defense-prime.example",
        "ports": [
          443,
          22
        ],
        "persona": "Compliance lead, defense contractor",
        "organization": "Defense Prime Integrator",
        "mandate": "CMMC Level 2 / CNSA 2.0 alignment"
      },
      "manualBaseline": {
        "inventoryWeeks": 6,
        "assetsFound": 28,
        "quantumVulnerable": 24,
        "readinessScore": 22,
        "summary": "Manual SSP spreadsheet; no JWKS or SSH host key coverage."
      },
      "fixtureAssetIds": [
        "tls-api-bank",
        "jwks-oidc",
        "ssh-bastion",
        "code-sign-legacy"
      ]
    },
    {
      "id": "healthcare-insurer-hndl",
      "title": "Healthcare insurer HNDL exposure",
      "summary": "Legal and security teams stress-test harvest-now-decrypt-later risk on long-retained PHI transport encryption.",
      "target": {
        "domain": "member.healthshield.example",
        "ports": [
          443,
          25,
          993
        ],
        "persona": "CISO, healthcare insurer",
        "organization": "HealthShield Mutual",
        "mandate": "HIPAA + board Q-Day readiness"
      },
      "manualBaseline": {
        "inventoryWeeks": 10,
        "assetsFound": 55,
        "quantumVulnerable": 51,
        "readinessScore": 15,
        "summary": "Third-party email and legacy signing keys not in last inventory cycle."
      },
      "fixtureAssetIds": [
        "tls-auth-bank",
        "email-mx",
        "jwks-oidc",
        "code-sign-legacy",
        "discovery-ct-api"
      ]
    }
  ]
}