Analytics & Reports
What this screen is for
Analytics & Reports holds eight reports over your tenant's key estate, one per tab: Key Health Summary, Expiration Report, Algorithm Usage, Most Used Keys, Migration Candidates, Component Distribution, Keys by Component and Usage Limits. Every report is computed when you open its tab, from the keys of your tenant that currently have material and were not deleted. None of them reads the audit trail: the operation counts here are the counters kept on each key, not the events the Audit Log lists.
Nothing on this screen changes your tenant. What you choose is which report to read, its horizon or size where it has one, and whether to download the two reports that offer a CSV file. A report that could not be read is replaced by its own error and a Retry; the other tabs are unaffected.
What must exist first
The screen is offered to SIMPLE and STANDARD tenants alike, and it is in the navigation of every built-in tenant role, the key manager included.
- The permission to read tenant analytics is the one permission every tab and both exports need. Every built-in tenant role holds it.
- The permission to read an audit trail is needed only for the Go to Audit Log action shown when Most Used Keys has no rows; without it the empty state has no action.
A platform administrator who opens the screen without assuming a tenant is told No tenant selected, and no report is requested.
Decisions you make here
Knowing which keys a report counts
Two populations appear under the same Total Keys label, and each card says which one beneath the figure. Key Health Summary and Most Used Keys count every key your tenant still holds, in every lifecycle state short of deleted: revoked, archived and pending-destruction keys included. Algorithm Usage and Migration Candidates count keys whose status is ACTIVE only, so their totals are smaller on a tenant with expired or revoked keys, and a revoked key stops counting against adoption.
Usage Limits, and the Keys Approaching Usage Limit figure of Key Health Summary, count live keys only: active, expired and suspended. A revoked, archived or pending-destruction key is out of both, so the two keep giving the same answer.
Reading Key Health Summary
Total Keys, Active Keys, Expired Keys and Revoked Keys are status tallies. Rotated Keys is shown inside the Active card as a share of the active keys: an active key whose current material is not its first. The Status Distribution bar partitions the total into those three statuses only, so a suspended, archived or pending key is in the total and in no segment.
Keys in Warning Period counts active keys past their soft expiration and not yet past the hard one; Keys Approaching Usage Limit counts live keys that have reached the soft threshold of a positive hard limit, including keys at the limit. A key goes past its limit only when the limit is set or lowered below the uses it has already recorded. Total Cryptographic Operations is marked Measured over all time, but it is the sum of each key's current material counter, and a rotation starts that counter again at zero: after a rotation the figure falls by the rotated key's previous count.
Setting the expiration horizon
Threshold days is the look-ahead of the Expiration Report, 360 by default and at least 1, applied when you press Generate Report. Hard Expiration lists active keys whose expiry date falls within the horizon and that are not already in the warning period. Soft Expiration Warning lists active keys past their soft expiration and not yet hard-expired, whatever the horizon. Each row carries the days left and an urgency the report itself bands: critical under 7 days, warning under 30, caution under 60.
Action Required counts both lists, so with the default horizon a key expiring in eleven months is counted as requiring action. The Hard Expiration hint says the key stops working and cannot be used for crypto operations after that date; the server refuses encrypt and sign on an expired key and keeps decrypt and verify available, as your key lifecycle policy allows. The timeline groups the listed keys into 30-day buckets.
Reading Algorithm Usage
The report counts active keys per algorithm. PQC Adoption is the post-quantum and hybrid share of them; a symmetric key counts in Total Keys and in none of Classical, Post-Quantum or Hybrid, so a tenant holding only AES keys reads 0% and three zero cards. Top Algorithms is sorted by key count, and its category badge reads Classical for a symmetric algorithm.
Reading Most Used Keys and exporting it
Show top takes 1 to 100 and applies when you press the refresh button; the rows on screen and the Export CSV file both use the last applied value, not what the field currently holds. Keys of every status short of deleted are ranked by their current material counter, each with its status, so a revoked key keeps its recorded usage; a key rotated yesterday ranks near the bottom whatever it did before. Usage % is shown only for a key with a positive hard limit and is the report's own figure. Total Cryptographic Operations here is the same all-time-labelled sum as on Key Health Summary.
Reading Migration Candidates
The headline is the share of active keys that carry quantum debt, over the active total named beneath it. Each candidate gets a recommended post-quantum algorithm from its current one, or from its operations when the algorithm is not on the recommendation list, and a priority scored from three signals: usage above 1,000, 10,000 or 100,000 operations; age above 6, 12 or 24 months; and a small parameter, 1024 or P-192 scoring higher than 2048 or P-256.
Six points or more is CRITICAL, four HIGH, two MEDIUM, otherwise LOW; medium and low candidates are collapsed behind a toggle.
Reading the composite reports
Component Distribution counts the components of your composite keys' current material and their classical and post-quantum shares. The balance verdict is the server's: Balanced when the two shares are within 10 percentage points, otherwise the dominant side is named; a tenant with no composite keys is told so rather than given a verdict.
Keys by Component lists the composite keys whose components include the algorithm you type, matched exactly and case-sensitively, so ml-kem-768 finds nothing that ML-KEM-768 finds.
Reading Usage Limits and exporting it
The population is live keys — active, expired or suspended — with a positive hard limit; a blank or 0 limit means unlimited and keeps the key out of the report, and so does revoking, archiving or marking it for destruction. Above Soft Limit uses the same rule as Key Health Summary's usage row, and the two percentage cards use the boundaries the report publishes, 75% and 90% today. Export CSV is offered even when no key has a limit.
A hard limit takes effect on the next forward operation: once the counter reaches it, encrypt and sign are refused and the key's status becomes EXPIRED, while decrypt and verify continue. The Max Limit hint says the key is blocked from further use, which overstates it. The soft limit only adds a warning to the responses of operations on the key.
How it relates to other screens
The Dashboard summarises Key Health Summary, Algorithm Usage and Migration Candidates and links here for the full reports:
Expiration dates and usage limits are properties of each key, set on the key itself and shown on its detail; the rows here name the key by its identifier so you can find it:
The operations a key performed are recorded one by one in the audit trail, which is where a counter that a rotation reset can still be reconstructed:
Which algorithms carry quantum debt for Migration Candidates and Algorithm Usage is fixed by the platform's algorithm classification, not by your policies; your policies decide what a key may rotate to: