Topic starter
25/06/2026 2:39 pm
TL;DR: The PKI Consortium’s PQC Conference 2025 shifted the conversation from algorithm selection to execution, with discovery, inventory, maturity, and automation now treated as the practical starting points, according to Keyfactor’s conference reflections. The real governance challenge is no longer whether post-quantum change is coming, but whether identity and cryptographic programmes can adapt continuously without creating new technical debt.
Editorial analysis by NHI Mgmt Group, based on content published by Keyfactor: “From Kuala Lumpur to Crypto-Agility: Reflections from the PKI Consortium’s PQC Conference 2025”.
Key questions
Q: How should security teams start a PQC readiness programme?
A: Start with cryptographic inventory, not with algorithm selection.
Q: Should organisations prioritise crypto-agility before final PQC standards are settled?
A: Yes. Waiting for complete standard stability delays the work that makes migration possible. Organisations can already improve inventory quality, centralise certificate control, and remove manual dependencies. That preparation reduces the risk that future algorithm changes will disrupt authentication, trust chains, or service availability.
Q: Where do PQC migrations usually fail in practice?
A: They often fail in brittle paths such as older stacks, MTU-sensitive links, UDP-heavy protocols, deep proxy chains, and systems with hard-coded size limits.
Practitioner guidance
- Map cryptographic dependencies across the estate Inventory every certificate, key, algorithm and trust anchor across applications, workloads and infrastructure so you can see where PQC change will land first.
- Assign priority by business criticality Rank systems by operational impact, external exposure and renewal complexity so migration sequencing reflects risk rather than convenience.
- Reuse certificate lifecycle automation Extend existing issuance, renewal and policy workflows so PQC transition work does not depend on manual change management.
Bottom line: The article’s core message is that PQC preparedness is now an operational governance problem, not an abstract standards debate.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 3:47 pm
Crypto-agility is now a governance discipline, not a standards watch exercise. The article shows that the question has moved from which post-quantum algorithms will win to whether organisations can adapt continuously as trust requirements change. That changes the operating model for PKI, certificate management and identity infrastructure. The practitioner conclusion is that crypto-agility has to be owned as an ongoing programme, not a one-time migration.
A few things that frame the scale:
- According to the 2023 State of Machine Identity Management report, only 47% of companies have enough staff dedicated to their PKI.
A question worth separating out:
Q: Should hybrid PKI be the default during quantum transition?
A: No. Hybrid approaches can be useful where platform or certification support lags, but they should remain a transitional design choice, not a reason to postpone the programme. Teams should define where hybrid is necessary, where pure PQC is already viable, and when to exit mixed-mode trust.
👉 Read our full editorial: Crypto-agility after the PQC conference: what practitioners need now