For security teams, PQC preparation is primarily an inventory, dependency and migration problem. Organizations need to know where public-key cryptography is used before they can evaluate compatible replacements, hybrids and rollout constraints.
Why inventory comes first
Public-key cryptography appears in TLS certificates and key exchange, code signing, identity systems, software updates, document signing, secure messaging and many embedded dependencies. The same algorithm can have very different owners and migration paths in each context.
An external TLS scan can reveal public exposure, but it cannot prove that internal PKI, repositories, endpoints or application-layer cryptography have been inventoried. PQC programs need progressive coverage across those sources.
Cryptography that needs different migration treatment
| Observation | Operational treatment |
|---|---|
| RSA and elliptic-curve public-key cryptography | Review the dependency and plan a standards-aligned replacement or approved hybrid path |
| Symmetric encryption and hashing | Assess separately; do not label the organization quantum-safe based on these observations |
| Unknown or ambiguous key establishment | Confirm with stronger evidence before assigning a migration action |
| Legacy protocol behavior | Address protocol security and compatibility as a related but distinct modernization concern |
NIST PQC standards and implementation choices
NIST standardized ML-KEM for key establishment and ML-DSA and SLH-DSA for digital signatures in FIPS 203, FIPS 204 and FIPS 205. Standards define algorithms; they do not remove application, protocol, certificate, hardware and interoperability work.
Security teams should track the exact standards and implementation profiles used by their platforms. Avoid inventing migration deadlines or assuming every product supports the same algorithms and hybrid modes.
Practical preparation
- Discover
Identify public-key cryptography and the systems that depend on it.
- Classify
Separate direct observations, deterministic inference and unknowns.
- Prioritize
Consider data lifetime, exposure, interoperability and owner readiness.
- Pilot
Test supported standards or hybrid approaches in controlled environments.
- Verify
Repeat discovery to confirm old dependencies are removed and coverage is understood.
Frequently asked questions
Does PQC preparation mean RSA is broken today?
No. PQC planning addresses future cryptographic risk and long migration lead times. It should not be presented as evidence that quantum computers can currently decrypt properly implemented RSA in operational systems.
What is a hybrid migration?
A hybrid approach combines classical and post-quantum mechanisms so security does not rely entirely on one family during transition. Exact constructions must follow the protocols and profiles supported by the systems involved.
Can a scanner make an organization quantum-safe?
No. Discovery can reveal evidence and coverage. Migration still requires ownership, compatible implementations, testing, deployment and verification across the organization.