ABArijit BiswasIndependent Technology & Risk Advisor
Post-quantum migration readinessFor regulated institutions. Inventory, exposure, roadmap, board briefing.Technical due diligenceFor investors. Architecture, security and regulatory exposure, reported to the IC.InsightsWriting on cryptography, energy and verificationAbout and evidenceThe record, and what you can checkStart a conversation
Independent Technology & Risk Advisor • US · UK · GCC · India

Most institutions cannot list their own cryptography. That is the problem — not the quantum computer.

I build the inventory, measure the exposure against how long your data has to stay secret, and hand your board a decision it can defend. Four to eight weeks, fixed fee, priced before the work starts.

Start a conversation →Check your exposure

Ninety seconds. No email required for the check.

Arijit Biswas
Kolkata · working across four markets
01

US patent 19/330,220

Sole inventor and sole applicant. Energy-aware compute scheduling, with the saving attested rather than asserted.

02

Post-quantum Layer-1, in production

Quantum-resistant primitives designed into the consensus layer, not retrofitted. Live since March 2026.

03

Group CTO, three jurisdictions

UAE, India and US entities. Around eighty engineers, and the compliance surface that comes with them.

04

Both sides of the table

Four years in derivatives risk before the engineering. It is why the architectures survive review.

What I keep hearing

Three versions of the same conversation

Start a conversation →

We know we need to do something. We do not know what we have.

No migration can be planned off an estate nobody can enumerate. The inventory is the unglamorous part, it is where programmes stall, and it is the only place to start.

The board asked, and we gave an answer we are not confident in.

Answering a risk committee from intuition survives one meeting. It stops surviving when they ask what it costs and when it will be done.

Everyone selling us a solution has a solution to sell.

Fair. The fee is fixed before the work starts and does not move with what the assessment concludes, and no vendor pays me anything.

The exposure check • free, no email required

Whether you have a problem today is arithmetic, not prophecy

Mosca’s inequality is the standard framing and it takes three numbers. When the time your data must stay secret plus the time your migration takes exceeds the time until the threat lands, traffic captured today is already exposed. Set the sliders to your own position.
10 years

How long the most sensitive thing you transmit today must stay confidential. Mortgage files, KYC records, medical underwriting and long-dated contracts push this higher than most teams expect.

5 years

Decision to last system re-keyed, across every jurisdiction and counterparty integration. For a large regulated estate this is seldom under five.

12 years

Your own assumption about a cryptographically relevant quantum computer. Published estimates vary widely, which is why this is a slider and not a fact.

Already exposed

3 years short

On these numbers, data you transmit today is still sensitive when its protection fails. Traffic captured now can be stored and read later, so the exposure has already started. The programme is urgent because the clock started, not because of a date in the future.

x + y > z → act now

A framing device, not an assessment. Establishing what your shelf-life and migration time really are is most of what the engagement does.

Engagements

Two things, done properly

For regulated institutions

Post-quantum migration readiness

An inventory of what you actually run, an exposure measured against the lifetime of what you protect, a sequenced roadmap, and a briefing your risk committee can act on.

  • Cryptographic inventory across systems, jurisdictions and counterparty integrations
  • Exposure quantified against data lifetime rather than a headline date
  • Migration roadmap with sequencing, dependencies and cost bands
  • Board briefing, written for people who are not engineers

Four to eight weeks · fixed fee · optional retainer

See the engagement →

For investors and acquirers

Technical due diligence

An independent read on what a target has really built, written for the people who have to price the risk rather than for the people who built it.

  • Architecture and scalability claims tested against the evidence
  • Security posture, cryptographic assurance and key management
  • Regulatory exposure across the jurisdictions it actually operates in
  • Written report for the investment committee, risks ranked and priced

Two to four weeks · fixed fee · reports to the IC

See the engagement →
Evidence

Four minutes of checking, and you will know what you are dealing with

The full record →
  1. 01

    US patent application 19/330,220

    Energy Aware Infrastructure Management. Filed 16 September 2025, sole inventor and sole applicant, no assignee. Publication projected March 2027, so the filing receipt is the document to read.

    Filing receipt
  2. 02

    Panel — “The RWA Revolution: Tokenising Trillions in the Real World”

    Istanbul Blockchain Week, 13 August 2024. Moderated by BeInCrypto, alongside the CEO of MANTRA, the CEO of Chateau Capital, and Ava Labs’ head of Turkish business development.

    Watch it
  3. 03

    Diamante Quantum White Paper

    Credited contributor. Architecture, cryptographic primitive selection and state-machine design for a quantum-resilient Layer-1 now running in production.

    Read it
Insights

Writing on cryptography, energy and verification

All writing →

In progress

Flexibility is becoming a traded commodity. Nobody can assay it.

Data centres are trading curtailment commitments for interconnection speed. Every one of those claims is a counterfactual, and counterfactuals are self-reported by definition.

Long read · publishing shortly

Planned

What actually breaks when you swap a cryptographic primitive

The standards question is settled. The estate question is not: key sizes your HSMs will not hold, integrations that stop negotiating, handshake latency on the payment path.

Field notes

Interactive

The exposure check

Mosca’s inequality with your own numbers in it. Ninety seconds, no email, and it tells you whether the arithmetic has already turned against you.

Tool · on this page

Start a conversation

Tell me what you are dealing with

Three short steps, about ninety seconds. It means the first call opens on your situation rather than on introductions.

Which of these is closest?

This decides what I ask next, and what I read before we speak.

What happens next

A twenty-minute call on your situation, then a one-page written scope with a fixed price. Both free, and the scope is yours to take elsewhere.

Response time

Two working days, from me rather than an assistant.

Confidentiality

What you send stays between us. An NDA before the first call is fine, and I will sign yours rather than send mine.

Direct

arijit@workheartz.com