In a general aspect, upgradability scores are determined, and remedial security measures are identified in a computing environment. The computing environment is analyzed to identify computing resources that are eligible to receive a cryptographic security upgrade. Attributes of the computing resources are identified based on communicating with the computing resources. A set of rules, that define upgradability scores as a function of computing resource attributes, is obtained. Sets of intermediate output values are generated for the respective computing resources by applying the set of rules to the identified attributes of the respective computing resources. Upgradability scores are generated for the respective computing resources from the set of intermediate output values for the respective computing resource. Remedial security measures are identified for respective subsets of the computing resources based on the upgradability scores for the respective subsets.