PQCClear Research
Reading Between the Lines: How PQCClear Surfaces Contradictions in Vendor Answers
September 15, 2026 · PQCClear · 6 minute read
Last piece, we talked about why PQCClear scores evidence without dictating what risk your institution should accept. There's a second, quieter layer to that evidence worth its own space: sometimes a vendor's own answers don't agree with each other, and that disagreement is itself a finding.
A Complete Answer Isn't Necessarily a Consistent One
Most of what a questionnaire-based assessment can catch is a weak individual answer: an outdated algorithm, a missing migration plan, a vendor who simply doesn’t know their own cryptographic posture. Those are real, useful findings. But they’re not the only kind of useful signal a full set of answers can contain.
Some answers, considered together rather than individually, quietly can’t both be true. A vendor who claims to maintain a rigorous, board-approved cryptographic inventory in one part of the questionnaire, and separately states they don’t actually know what encryption libraries their own systems use, has told you two things that don’t fit together. Individually, neither answer looks alarming. Read side by side, they raise a real question worth asking directly.
What This Looks Like in Practice
Answer A
“We maintain a rigorous, actively governed internal review process for our own cryptographic practices.”
Read on its own, unremarkable. Plenty of vendors say some version of this, and for plenty of them it is true.
Answer B, later in the same assessment
“The specific encryption method protecting our most sensitive data category is unknown.”
Also unremarkable on its own, and more forthcoming than a vague non-answer would have been.
We want to be precise about what this is and isn’t. Flagging a contradiction is not the same as accusing a vendor of dishonesty. Answer inconsistencies happen for all kinds of ordinary reasons, different people filling out different sections, a genuine misunderstanding of a question, a process that’s real on paper but hasn’t actually been tested. But whatever the underlying reason, it’s information your own review process deserves to see, not something a scoring average should quietly smooth over.
A contradiction doesn’t prove dishonesty. It proves something is worth asking about directly.
Why This Stays a Flag, Not an Automatic Penalty
It would be simple to build a rule that automatically deducts points whenever two answers don’t align. We’ve deliberately held back from doing that, for the same reason we don’t dictate what score is acceptable to you: a rule built before we’ve seen how these patterns actually play out across real, live assessments risks punishing an honest mistake as harshly as genuine misrepresentation, and we’d rather be right than fast about that distinction.
See the full picture, contradictions included
PQCClear’s assessments are read as a whole, not just scored question by question, so nothing worth asking about gets lost in an average.
Get in touchThis piece reflects PQCClear’s own methodology and philosophy as of September 15, 2026. It does not disclose the specific consistency checks, weighting, or internal scoring mechanics of PQCClear’s assessment platform, which remain proprietary. It should not be construed as legal, regulatory, or investment advice.
The vendor answers shown above are illustrative composites written for this piece, not excerpts from any real assessment.