Customer journey
From first scan to proof of fix
The vulnerability list is the hook. Monitor + evidence is the product. Convert is the high-value sticky tier.
Stage 1 — Inventory
First scan complete; findings in spreadsheet
Recommended tier: Assess
Core insight
Never sell Stage 6 to a Stage 0 buyer
Always propose the next maturity stage plus one. Optimization is expansion — only after PQC defense is proven.
Personas
CISO / VP Security
Trigger: Board asks: how much RSA/ECDSA before 2030?
Entry: /assess → Assessment → Monitor
Compliance / GRC lead
Trigger: CMMC, PCI-DSS 4.0, or HIPAA audit
Entry: Scenario packs → signed compliance pack
VP Engineering
Trigger: Assigned to execute PQC migration
Entry: CBOM → remediation board → re-scan verification
Touchpoints by channel
| Channel | Assess | Monitor | Convert |
|---|---|---|---|
| Website | /assess | /monitor | /convert |
| Self-serve | /assess | /access | /access |
| Dashboard | Scan history | Drift + schedules | Remediation board |