Topic starter
06/11/2026 6:56 pm
TL;DR: Google's 2029 quantum-safe target shortens the post-quantum cryptography window and leaves most organisations without a migration roadmap, according to AppViewX's analysis. Practitioners need visibility into cryptographic assets now, because identity, certificates and signed tokens are all tied to algorithms with a shrinking lifespan.
Editorial analysis by NHI Mgmt Group, based on content published by AppViewX: “Post-Quantum Cryptography: Google’s 2029 Migration Timeline”.
By the numbers:
- Google is targeting 2029 to be quantum-safe.
Key questions
Q: Why does PQC migration depend on crypto-agility?
A: PQC migration depends on crypto-agility because systems must be able to swap algorithms, key sizes and certificate formats without redesigning the whole service.
Q: Why is harvest now, decrypt later a current risk?
A: Because the attacker does not need quantum capability today to create value from stolen ciphertext.
Q: How should teams inventory cryptographic assets before PQC migration?
A: Teams should inventory every cryptographic asset by key type, algorithm, certificate issuer, key length, usage, expiry, and where it is embedded, including code, HSMs, secrets stores, and device firmware.
Practitioner guidance
- Inventory cryptographic assets first Map every certificate, key, signed token, TLS endpoint, HSM dependency and code-signing flow before setting migration priorities.
- Rank assets by confidentiality shelf life Prioritise data and trust chains that must remain secret for years, including IP, biometrics, government material and M&A records.
- Design for algorithm substitution Separate identity issuance and validation logic from hard-coded algorithms so new PQC choices can be introduced without platform redesign.
Bottom line: The core risk is not abstract quantum theory but the gap between a 2029 target and the time required to discover, prioritise and replace cryptographic dependencies.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:56 pm
Cryptographic inventory is now an identity governance control, not a pure crypto task. Every certificate, signed token and machine identity depends on algorithms that will not age evenly across the estate. That means ownership, lifecycle and dependency mapping matter as much as cipher choice. Practitioners should treat visibility into cryptographic assets as a prerequisite for any credible PQC programme.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- 96% of security operations teams report critical blind spots, most commonly in cloud infrastructure (74%) and identity and access behaviour (67%).
A question worth separating out:
Q: What should teams prioritise before the 2029 quantum-safe deadline?
A: Teams should first prioritise high-value data, long-lived secrets, and systems that handle public-key encryption, digital signatures or certificate-based trust. Those dependencies usually take the longest to change, so inventory them early, identify protocol and library constraints, and plan hybrid deployments, certificate replacement and testing before the 2029 quantum-safe deadline.
👉 Read our full editorial: Google's 2029 quantum-safe target raises the stakes for crypto-agility