Conversations about post-quantum cryptography usually start with algorithms: ML-KEM for key exchange, ML-DSA for signatures, hybrid TLS. Those matter. But in our experience they are not where a programme succeeds or stalls.
It stalls on a simpler question: where does our organisation actually use cryptography?
Why the list is hard
Encryption is everywhere and mostly invisible. It sits in TLS certificates on load balancers, in libraries bundled inside applications, in hardware security modules, in VPNs, in code-signing, in vendor products that nobody has looked inside for years. Some of it is configured; some of it is compiled in. Few organisations have a single list.
What a useful inventory contains
- Every key and certificate, with its algorithm, key size, owner and expiry.
- Every library and protocol version that performs cryptography, per application.
- Hardware dependencies, such as HSM models and firmware.
- Third-party and vendor systems, and what they have said about their own migration.
- For each system, how long its data needs to stay confidential.
That last item is what turns a list into a plan. Data that must stay secret for twenty years is already at risk from anyone recording traffic today and decrypting it later. Data that is useless in a month is not.
Start small
We suggest taking one business-critical application and doing its inventory properly, end to end. It is a contained piece of work, it shows the tooling and ownership questions early, and it gives a realistic estimate for the rest of the estate.
The white paper sets out the full sequence, and our quantum-safe services cover each step.