TL;DR: Quantum-safe migration is being blocked less by algorithm choice than by the inability to inventory where vulnerable cryptography lives across identities, applications, and infrastructure, according to Axiad’s analysis of Gartner, CISA, and NIST guidance. The decisive issue is visibility: organisations cannot plan PQC transition until they can map certificates, keys, and dependencies end to end.
At a glance
What this is: This is an analysis of PQC readiness that says comprehensive cryptographic inventory, not algorithm selection, is the hard prerequisite for migration planning.
Why it matters: IAM, NHI and platform teams need a unified view of certificates, keys and dependencies because cryptography is embedded across identity systems, applications and infrastructure.
Context
Post-quantum cryptography readiness is an identity and infrastructure visibility problem as much as a cryptography problem. The practical blocker is not whether teams know the quantum transition is coming, but whether they can enumerate every place cryptography is used across human identities, machine identities, applications and platform services.
Axiad’s analysis frames cryptographic inventory as the control point that makes PQC migration governable. Without a trustworthy map of certificates, keys, algorithms, lifecycles and dependencies, organisations cannot assess exposure, sequence remediation or make the transition crypto-agile in a controlled way.
Key questions
Q: How should security teams start a PQC readiness programme?
A: Start with cryptographic inventory, not with algorithm selection. Teams need a complete map of certificates, keys, algorithms, dependencies and owning identities before they can scope exposure or sequence migration. Without that baseline, PQC planning becomes speculative and remediation priorities will be wrong.
Q: When should organisations prioritise one cryptographic dependency over another in a PQC migration?
A: Organisations should prioritise cryptographic dependencies by combining technical severity with business exposure, operational criticality, and dependency weight. A vulnerable asset is not automatically the first one to fix. The practical test is whether changing it affects important services, high-risk workflows, or downstream systems that would slow or disrupt the migration.
Q: What are the signs that PQC readiness is failing in practice?
A: The main warning signs are incomplete inventories, unknown certificate owners, untracked renewal dates, hard-coded algorithms and discovery tools that only cover one layer of the stack. When teams cannot answer where cryptography lives or what depends on it, the programme is not ready to migrate.
Q: What should organisations do when quantum migration timelines shorten?
A: They should accelerate discovery, prioritisation and governance before they attempt mass substitution. The practical response is to identify critical identities, map vulnerable cryptography to those services, and align migration sequencing to risk and business dependency rather than to asset count alone.
Technical breakdown
Why cryptographic inventory is the first PQC control
Post-quantum migration is not a single algorithm swap. It is a discovery problem because modern enterprise cryptography is distributed across PKI, identity systems, applications, endpoints, cloud services and machine identities. A comprehensive cryptographic inventory must show where each algorithm is used, which certificates and keys exist, what depends on them, and which systems will fail when those primitives change. That is why point tools miss embedded cryptography and why incomplete inventories create false confidence. The real dependency is between visibility and migration sequencing: if you cannot map the cryptographic estate, you cannot govern the change. Practical implication: build the inventory before you set migration timelines.
Practical implication: build the inventory before you set migration timelines.
How identity systems and machine identities complicate PQC readiness
Cryptography is not abstract infrastructure. It is attached to identities. Certificates bind users, devices, services and applications; API keys and SSH keys bind machine access; federation and SSO rely on cryptographic trust chains. That makes PQC readiness an IAM and NHI governance issue because the migration surface includes both credential objects and the identities they authenticate. The dependency problem is especially sharp for service accounts and other machine identities, where credentials are often embedded in workflows, linked to vendor products, or spread across cloud and on-premise estates. Practical implication: map cryptographic objects to ownership, identity type and business service, not just to hosts or subnets.
Practical implication: map cryptographic objects to ownership, identity type and business service, not just to hosts or subnets.
What crypto-agility really means in operational terms
Crypto-agility is the ability to replace cryptographic algorithms without a full redesign of the surrounding system. In practice, that requires inventory, policy, dependency mapping and testing because post-quantum algorithms will differ from classical cryptography in key size, signature size and performance profile. If applications, certificates or embedded libraries are hard-coded around current primitives, the migration becomes a re-engineering programme rather than a controlled substitution. Crypto-agility therefore depends on lifecycle governance as much as cryptographic choice. Practical implication: treat algorithm substitution as an architectural and lifecycle change, not a patch cycle.
Practical implication: treat algorithm substitution as an architectural and lifecycle change, not a patch cycle.
Threat narrative
Attacker objective: The attacker’s objective is to preserve access to encrypted data or trust chains until quantum capability makes current cryptography unreadable.
- Entry begins when adversaries collect encrypted traffic or stored data now, banking on later decryption once quantum capability matures.
- Escalation occurs when organisations fail to inventory where RSA, ECC and other quantum-vulnerable cryptography sits, leaving exposed certificates and keys undiscovered.
- Impact arrives when migration is delayed until the deadline pressure forces rushed replacement, creating coverage gaps, operational disruption and residual exposure.
Breaches seen in the wild
- Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Cryptographic inventory is the governing control that turns PQC from a theory problem into a migration programme. The article is right to place discovery ahead of substitution because enterprises cannot prioritise what they cannot enumerate. That makes inventory the baseline control for both cryptographic risk and identity-linked trust chains. Practitioners should treat discovery completeness as the first measure of readiness.
Post-quantum readiness is also an identity governance problem, not only a cryptography programme. Certificates, keys and algorithms are bound to users, workloads, devices and services, so the migration surface crosses IAM, NHI and platform ownership. The important governance question is not just which algorithm to adopt, but which identity owns each cryptographic dependency and how that ownership is maintained through lifecycle change.
Cryptographic visibility debt is the named condition this article exposes. Organisations that do not maintain a current map of cryptographic assets accumulate hidden dependencies, unknown renewal points and unquantified replacement effort. That debt is what turns a planned migration into a rushed remediation exercise, and it should be measured as a programme risk in its own right.
Crypto-agility is now a lifecycle discipline, not a technical preference. The article shows that algorithm substitution will fail where applications, certificates and embedded libraries were never designed for change. That means the field should stop treating PQC as a future crypto choice and start treating it as a governance model for how cryptography changes over time.
The 2029 framing matters less as a date than as a forcing function for inventory discipline. The article’s core warning is that delay compresses the available remediation window and magnifies unknown dependencies. For practitioners, the lesson is to surface cryptographic exposure now, because the organisational cost of ignorance rises faster than the cost of inventory.
What this signals
Cryptographic visibility debt: PQC readiness fails when organisations treat encryption as a property of systems rather than as a property of identities, certificates and lifecycle ownership. The practical shift is to track cryptographic change with the same discipline used for identity lifecycle governance, or migration plans will stay incomplete.
The current transition challenge is not simply replacing RSA or ECC. It is proving which workloads, services and trust chains depend on them, then deciding which dependencies can move first without breaking authentication or signing workflows.
For practitioners
- Build a cryptographic inventory across identity estates Catalogue certificates, keys, algorithms, lifecycles and dependencies across PKI, identity platforms, applications, endpoints and cloud services.
- Map cryptographic objects to identity ownership Tie each certificate, API key, SSH key and trust chain to a user, service, workload or application owner so remediation has a clear accountability path.
- Prioritise quantum-vulnerable dependencies first Rank RSA, ECC and other vulnerable implementations by identity criticality, data sensitivity, renewal timing and business service impact.
- Test crypto-agility in application and federation paths Validate whether systems can swap algorithms without redesign, including SSO, federation, code signing and machine-to-machine authentication flows.
- Establish policy for algorithm substitution and retention Define how long sensitive data must remain protected, when older algorithms must be retired and who approves migration exceptions.
Key takeaways
- The article’s central point is that PQC migration is blocked by discovery gaps, not by a lack of concern about the quantum threat.
- Cryptographic inventory has to cover certificates, keys, algorithms and the identities that own them, or the migration plan will miss critical dependencies.
- Practitioners should treat crypto-agility and ownership mapping as governance problems now, because delay turns a controlled transition into a rushed and fragile remediation effort.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | Cryptographic inventory must find exposed keys, certificates and other secrets across the estate. |
| NHI-07 — Long-Lived Secrets | The article stresses renewal timing and delayed replacement of quantum-vulnerable credentials. | |
| Recommendation — Scan for exposed secrets and maintain a complete inventory of cryptographic credentials. Reduce secret lifetime and flag long-lived cryptographic credentials for priority migration. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | IA-5 governs credential lifecycle management, which this article links to certificate and key inventory. |
| Recommendation — Apply IA-5 to inventory, rotate and retire authenticators tied to quantum-vulnerable cryptography. | ||
| MITRE ATT&CK | TA0006 — Credential Access | The article’s threat model includes harvested encrypted data and trust material targeted for later use. |
| Recommendation — Map vulnerable cryptographic material to credential access risks and prioritise high-value assets. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Cryptographic credentials are part of identity authorisation and need governed visibility across systems. |
| Recommendation — Track permissions and cryptographic entitlements together so migration planning reflects real access paths. | ||
Key terms
- Cryptographic Inventory: A cryptographic inventory is a continuously updated record of keys, certificates, algorithms, libraries and trust anchors across an organisation. It is not a spreadsheet or one-time audit output. In practice, it links each asset to ownership, usage, lifecycle state and risk so teams can make remediation decisions.
- Crypto-Agility: Crypto-agility is the ability to change cryptographic algorithms, certificates, and trust dependencies without redesigning production systems. It matters because cryptographic standards evolve, and organisations need accurate inventories and automated lifecycle controls before they can migrate safely.
- Cryptographic visibility: Cryptographic visibility is the ability to see where keys, certificates, and algorithms exist, who owns them, and which services depend on them. It turns hidden trust dependencies into governed assets. Without it, teams cannot reliably assess exposure, prioritise remediation, or prove control effectiveness across identity and workload systems.
- Machine Identity Security: Machine identity security is the practice of protecting the digital identities used by software, devices, services, and automated processes. It covers how identities are issued, authenticated, authorized, rotated, monitored, and revoked across systems such as APIs, workloads, certificates, tokens, and service accounts to reduce misuse, impersonation, and unauthorized access.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 12, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org