Network visibility is central to post-quantum migration planning

At a glance

What this is: This is a Corelight analysis of why post-quantum cryptography migration depends on observing real network negotiations, not just reading inventories or vendor claims.

Why it matters: It matters because IAM, NHI, and platform teams need evidence of where classical, hybrid, and PQC-capable connections actually exist before they can scope migration risk or validate cryptographic controls.

By the numbers:

• 65% of human-to-Cloudflare traffic is already using some sort of hybrid or PQC-capable encryption.

Context

Post-quantum cryptography is the planning problem behind a broader governance gap: organisations often know what they intend to use, but not what their sessions actually negotiate in production. That matters because asymmetric cryptography underpins trust establishment and digital signatures, while the symmetric part of modern protocols remains comparatively resilient.

For identity and access teams, the important intersection is not quantum computing itself but the cryptographic dependencies behind TLS, SSH, certificates, and machine-to-machine trust. If those dependencies are not inventoried at connection level, organisations can misjudge exposure for service accounts, workload communication, and long-lived credentialed systems.

Corelight argues that the typical starting point is incomplete visibility, which is true for most enterprise environments rather than an edge case.

Key questions

Q: How should security teams start a post-quantum migration program?

A: Start by inventorying where cryptography is actually used, then measure external exposure first. Public domains, certificates, SSH keys, and service accounts should be mapped to owners and replacement paths before standards deadlines force a rushed program. A quick scan is useful, but the real work is governance, sequencing, and lifecycle control.

Q: Why does harvest now, decrypt later make quantum migration a current risk even before quantum computers exist?

A: Because encrypted data can be captured today and stored until future quantum capabilities make decryption feasible. The risk is highest for information that must stay confidential for years, such as health records, financial data, communications, and trade secrets. In those cases, delay is not neutral. It extends the window in which an attacker can preserve data for later compromise.

Q: What breaks when cryptographic posture is assumed instead of observed?

A: You can believe a system is protected by PQC-capable controls while the live connection quietly falls back to classical algorithms. That means inventories, CMDB records, and vendor claims can all overstate readiness unless they are validated against real handshake evidence and negotiated session data.

Q: What is the difference between PQC support and PQC negotiation in production?

A: PQC support means a system can use post-quantum algorithms in theory. PQC negotiation means a real session actually selected them on the wire. Teams need both capability and evidence, because only negotiated traffic shows whether the environment has genuinely moved beyond classical-only cryptography.

Technical breakdown

Why post-quantum risk sits in the asymmetric layer

Modern network sessions usually combine asymmetric cryptography for trust establishment and symmetric cryptography for data protection. RSA and elliptic curve cryptography carry the vulnerable trust and key-agreement function, while AES-like symmetric encryption remains comparatively strong against quantum attack. Post-quantum cryptography is designed to replace the asymmetric layer with algorithms that are not efficiently solvable by known quantum methods. The practical issue is that organisations often treat encryption as a single property, when the exposure is really about which part of the handshake remains dependent on RSA or ECC.

Practical implication: inventory the trust-establishment layer separately from bulk encryption so migration scope reflects the real exposure.

How negotiated cryptography differs from configured cryptography

A system’s supported crypto is not the same as the crypto actually negotiated on the wire. A PQC-capable client talking to a classical-only server will quietly fall back to classical algorithms, and the connection will still succeed. That means CMDB records, certificate stores, and vendor documentation can all look acceptable while the live session remains exposed. For governance, the control problem is not just what a device can do, but what each connection chose under real operating conditions.

Practical implication: validate negotiated algorithms from live traffic rather than assuming configuration support equals deployed protection.

Why a cryptographic bill of materials needs network evidence

A cryptographic bill of materials, or CBOM, maps algorithms, key lengths, certificates, libraries, endpoints, and the business services that depend on them. No single source can build that picture completely. Certificate tools know issued certs but not negotiation outcomes, scanners miss unmanaged or restricted environments, and software inventory misses runtime behaviour. Passive network data adds the missing evidence because it shows the handshake, the cipher suite, and the endpoint relationship at the moment of use. That is what makes CBOM useful for prioritisation instead of just documentation.

Practical implication: use passive network telemetry as the evidentiary layer in CBOM and ACDI programmes.

Threat narrative

Attacker objective: Preserve encrypted traffic now so it can be decrypted later and expose private information at scale.

1. Entry occurs when adversaries capture network traffic at scale, focusing on sessions whose confidentiality may matter long after collection.
2. Credential or trust compromise is not the immediate event here; the threat is future decryption of stored traffic once cryptographically relevant quantum computers become practical.
3. Impact is delayed disclosure of sensitive communications, including data whose value outlives the arrival of quantum capability.

Breaches seen in the wild

• CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Crypto inventory without connection-level evidence is a governance assumption, not a control. Organisations often believe certificates, CMDB entries, or vendor attestations tell them enough about cryptographic posture. They do not, because negotiated algorithms can differ from intended settings and only live traffic shows the difference. The practitioner conclusion is to treat network telemetry as the proof layer for post-quantum readiness.

Post-quantum migration is an identity and trust problem as much as a cryptography problem. TLS, SSH, service-to-service channels, and certificate-bound machine communication all depend on trust establishment at runtime. Where machine identity and workload trust depend on asymmetric cryptography, migration planning has to include the identities and services that negotiate those sessions, not just the algorithms themselves.

Harvest-now, decrypt-later changes the value of retention decisions. If protected data must remain confidential longer than the likely migration window, waiting becomes an exposure choice rather than a neutral delay. That makes long-lived credentials, sensitive records, and machine-to-machine traffic especially important to prioritise, because the confidentiality horizon determines whether classical crypto is already a liability.

Cryptographic bill of materials is becoming a control-plane requirement, not a documentation exercise. The article’s CBOM model is useful because it ties crypto to services, ownership, and business process dependency. For practitioners, the next step is to use that inventory to drive risk ranking, migration sequencing, and evidence for governance reviews.

From our research library:

• Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
• Read next: Machine Identity, PKI and Certificate Lifecycle Guide

What this signals

Cryptographic posture is becoming a runtime governance issue. The shift to post-quantum readiness will not be solved by certificate registers alone, because negotiated algorithms can drift from declared support. Practitioners should expect migration programmes to rely more heavily on passive evidence, change tracking, and service ownership than on static inventory outputs.

Machine identity programmes will be pulled into PQC planning whether or not they initiated the conversation. Certificates, service-to-service channels, and workload trust chains sit at the point where classical algorithms fail first. That makes this a practical identity governance issue, not just a crypto specialist topic, because service account and workload trust decisions will shape migration sequencing.

Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs. That same visibility gap is exactly why post-quantum inventories struggle to identify what is really negotiating on the wire, especially across unmanaged systems and machine-to-machine traffic.

For practitioners

• Build a cryptographic bill of materials Map algorithms, key lengths, certificates, libraries, endpoints, and dependent services into a single inventory that can support migration planning.
• Verify negotiated algorithms from live traffic Use passive network visibility to confirm what cipher suites and key exchanges are actually used, not just what systems claim to support.
• Prioritise long-lived data and credentials Rank systems by how long the protected data or credential state must remain confidential, then move the longest-horizon assets first.
• Separate support from exposure in reporting Distinguish between PQC-capable products and PQC-negotiated sessions so executive reporting does not overstate migration progress.

Key takeaways

• Post-quantum migration fails when teams treat configuration support as proof of real-world cryptographic posture.
• Live network negotiation is the decisive evidence for whether classical, hybrid, or PQC-capable algorithms are actually in use.
• The shortest path to a defensible migration plan is a cryptographic inventory tied to runtime traffic and business-service ownership.

Key terms

• Post-Quantum Cryptography: Cryptographic algorithms designed to remain secure against attacks from sufficiently powerful quantum computers. In practice, PQC is a migration problem as much as an algorithm problem because organisations must replace trust anchors, certificates, and secrets without breaking identity-dependent systems.
• Cryptographic Bill of Materials: A cryptographic bill of materials lists the cryptographic capabilities built into software components, such as supported algorithms and libraries. It is useful for component visibility, but it does not show live configuration, deployment context or actual runtime usage. That makes it a partial input, not the full governance record.
• Harvest now, decrypt later: An attacker strategy where encrypted traffic or stored data is collected today and decrypted later when better computing power becomes available. It matters to NHI governance because machine identities often protect the data paths and secrets most worth preserving over time.
• Negotiated Cryptography: Negotiated cryptography is the set of algorithms, key exchanges, and cipher suites that a live session actually selects during connection establishment. It can differ from what a system supports in theory, which is why runtime observation is more reliable than documentation alone.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners connect identity controls to the operational realities of modern security programmes.