Topic starter
23/10/2026 12:47 am
TL;DR: Migration planning depends on live network negotiations, not just whether systems appear PQC-ready, according to Corelight. Cryptographic inventories need runtime traffic evidence to show when classical, hybrid, or PQC-capable algorithms are actually in use.
Editorial analysis by NHI Mgmt Group, based on content published by Corelight: “Cryptography is negotiated, not configured: Why PQC readiness needs network data”.
By the numbers:
- 65% of human-to-Cloudflare traffic is already using some sort of hybrid or PQC-capable encryption.
Key questions
A: Because encrypted data can be captured today and stored until future quantum capabilities make decryption feasible.
Q: What breaks when cryptographic posture is assumed instead of observed?
A: You can believe a system is protected by PQC-capable controls while the live connection quietly falls back to classical algorithms.
Q: How should security teams start a post-quantum migration program?
A: Start by inventorying where cryptography is actually used, then measure external exposure first.
Practitioner guidance
- Build a cryptographic bill of materials Map algorithms, key lengths, certificates, libraries, endpoints, and dependent services into a single inventory that can support migration planning.
- Verify negotiated algorithms from live traffic Use passive network visibility to confirm what cipher suites and key exchanges are actually used, not just what systems claim to support.
- Prioritise long-lived data and credentials Rank systems by how long the protected data or credential state must remain confidential, then move the longest-horizon assets first.
Bottom line: Post-quantum migration fails when teams treat configuration support as proof of real-world cryptographic posture.
Glossary terms: Post-Quantum Cryptography, Cryptographic Bill of Materials, Harvest now, decrypt later, Negotiated Cryptography
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
23/10/2026 9:48 am
Crypto inventory without connection-level evidence is a governance assumption, not a control. Organisations often believe certificates, CMDB entries, or vendor attestations tell them enough about cryptographic posture. They do not, because negotiated algorithms can differ from intended settings and only live traffic shows the difference. The practitioner conclusion is to treat network telemetry as the proof layer for post-quantum readiness.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What is the difference between PQC support and PQC negotiation in production?
A: PQC support means a system can use post-quantum algorithms in theory. PQC negotiation means a real session actually selected them on the wire. Teams need both capability and evidence, because only negotiated traffic shows whether the environment has genuinely moved beyond classical-only cryptography.
👉 Read our full editorial: Network visibility is central to post-quantum migration planning
This post was modified 6 days ago by NHI Mgmt Group