Topic starter
24/06/2026 11:11 pm
TL;DR: As post-quantum standards settle and government guidance shifts from research to readiness, organisations are being pushed to inventory cryptography, assign ownership, and confront the hidden technical debt buried in certificates, keys, and embedded secrets, according to DigiCert. The real blocker is not quantum capability itself but the inability to see, govern, and change cryptography at enterprise scale.
Editorial analysis by NHI Mgmt Group, based on content published by DigiCert: “What the Dept. of War’s PQC Push Reveals about Cryptographic Debt”.
Key questions
Q: What breaks when teams plan PQC migration without a clear cryptographic inventory?
A: A missing cryptographic inventory creates hidden dependency risk.
Q: Why does cryptographic debt create more risk as post-quantum migration approaches?
A: Cryptographic debt becomes riskier because legacy cryptography cannot be changed in isolation without breaking dependent systems.
Q: Who should own PQC readiness in an organisation?
A: Ownership should sit across security architecture, identity engineering, PKI, application teams, and infrastructure governance, because cryptographic dependencies cross all of them.
Practitioner guidance
- Map the cryptographic estate Inventory where asymmetric keys, certificates, embedded secrets, and cryptographic libraries are used across cloud, identity, DevOps, mobile, IoT, and operational technology.
- Create a cryptographic bill of materials Document algorithms, key locations, certificate dependencies, and control ownership so migration decisions are based on evidence rather than assumptions.
- Assign migration ownership Name accountable owners for each cryptographic domain, including third-party dependencies, so PQC work does not stall between security and engineering.
Bottom line: Post-quantum readiness is exposing a governance problem as much as a cryptography problem, because most organisations still cannot fully see or own their trust infrastructure.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 7:56 am
Cryptographic debt is now an identity governance problem, not just a PKI problem. The article correctly shows that post-quantum readiness forces organisations to confront assets that were never designed to be enumerated, owned, and changed at enterprise scale. That includes certificates, keys, and embedded secrets that sit inside the identity fabric of cloud, DevOps, and application environments. The practical conclusion is that PQC planning belongs inside identity governance, because the migration surface is defined by trust relationships as much as by algorithms.
A question worth separating out:
Q: How do security teams know whether cryptographic agility is actually working?
A: Look for central policy control, asset visibility, and the ability to swap algorithms or providers without application redesign. If teams still need manual discovery and large-scale rework for each standards change, the environment is not agile, even if it is technically compliant today.
👉 Read our full editorial: Post-quantum cryptography exposes the scale of cryptographic debt