A Quantum-Adjusted Risk Model for Enterprise Infrastructure Across Data In Transit, In Use, and At Rest

Enterprise infrastructure operators face a critical challenge in prioritizing post-quantum migration, as quantum-related risk is not uniformly distributed across data in transit, in use, and at rest. Existing assessments rely on system-level evaluations or protocol-specific analyses, which do not capture the heterogeneity of exposure across infrastructure layers. This paper extends the Quantum-Adjusted Risk Scoring (QARS) model introduced in into an evidence-based, layer-specific framework that evaluates in-transit, in-use, and at-rest data separately. QARS applies a unified five-factor scoring framework separately to each data state and introduces a quantum-vulnerability attenuation mechanism grounded in Grover-bounded residual security that prevents overstating urgency for non-Shor-vulnerable symmetric protection. Observable host-level evidence determines the binary and ratio descriptors used by the model, while the fixed affine mapping coefficients are treated as transparent semi-quantitative calibration parameters. These coefficients are documented separately and subjected to coefficient-level sensitivity analysis to evaluate whether the reported layer ordering depends on their nominal values. The model is demonstrated through an illustrative controlled experiment using real infrastructure observations. Strengthening storage protection reduces the aggregate system risk from 0.707 (high) to 0.414 (moderate), a 41.5% reduction. However, the maximum-layer score remains high (0.657), indicating that the transport layer continues to dominate migration urgency. Sensitivity analysis confirms that the dominance of the transport layer is stable under wide perturbations of the calibration parameters. These findings demonstrate that risk reduction in one layer does not eliminate overall exposure but shifts the dominant vulnerability. By distinguishing between overall system posture and the most critical remediation priority, QARS supports infrastructure operators in identifying high-risk components and planning structured, evidence-based post-quantum migration.