Notifications
Clear all
Topic starter
25/06/2026 2:59 pm
TL;DR: Post-quantum preparation is increasingly being treated as an operating discipline, with governance, cryptographic visibility, hybrid cryptography, and rapid certificate rotation at the centre of the response, according to DigiCert’s Quantum Readiness Awards highlighting how Migros and NTT DATA are approaching the issue.
NHIMG editorial — based on content published by DigiCert: Migros named winner of the 2025 DigiCert Quantum Readiness Award
By the numbers:
- Only 5.7% of organisations have full visibility into their service accounts.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures.
- NHIs outnumber human identities by 25x to 50x in modern enterprises.
Questions worth separating out
Q: How should security teams prepare certificate governance for post-quantum migration?
A: Security teams should start with a complete inventory of certificates, keys, and trust dependencies, then classify which assets are long-lived, business critical, or embedded in hard-to-change systems.
Q: Why does quantum readiness matter to IAM and NHI programmes?
A: Quantum readiness matters because certificates and workload trust are part of the organisation’s identity fabric.
Q: What breaks when certificate lifecycle management is weak?
A: Weak certificate lifecycle management creates blind spots, stale trust, and higher outage risk during renewal or migration.
Practitioner guidance
- Build a cryptographic trust inventory Map certificates, keys, dependent services, owners, and renewal paths so you can see where long-lived trust exists and which assets require priority migration.
- Test certificate rotation at operational speed Rehearse renewal, revocation, and policy enforcement in production-like conditions so hybrid cryptography does not become a service continuity problem.
- Assign explicit ownership for trust assets Tie each certificate and workload trust dependency to a named team so lifecycle decisions are accountable and can be governed alongside IAM processes.
What's in the full analysis
DigiCert's full press release covers the operational detail this post intentionally leaves for the source:
- Award criteria and judging context for the 2025 Quantum Readiness Awards.
- The specific operational practices Migros used to organise its company-wide quantum readiness programme.
- NTT DATA's certificate lifecycle and hybrid cryptography operating model across cloud environments.
- The vendor's framing of why these readiness patterns matter for post-quantum migration planning.
👉 Read DigiCert’s Quantum Readiness Awards coverage for Migros and NTT DATA →
Quantum readiness and certificate governance: what IAM teams need to know?
Explore further
25/06/2026 4:15 pm
Quantum readiness is now a trust lifecycle problem, not a niche cryptography initiative. The article’s strongest signal is that organisations are being judged on whether they can govern certificates, visibility, and rotation as operating disciplines. That aligns with how modern identity risk accumulates across machine trust and workload access, where failure is usually about unmanaged lifecycle rather than a single weak cipher. Practitioner conclusion: post-quantum planning belongs in identity governance, not in a standalone crypto sandbox.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to Ultimate Guide to NHIs.
- 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage, showing how visibility gaps turn into real operational harm.
A question worth separating out:
Q: Who should own quantum readiness in an enterprise?
A: Quantum readiness should be owned jointly by identity, infrastructure, and risk leadership, with clear operational accountability for certificates, trust inventory, and renewal processes. If ownership sits only with a technical specialist team, the programme will struggle to scale across workloads and business units. Governance works when identity assets are managed as enterprise trust dependencies, not isolated crypto artifacts.
👉 Read our full editorial: Quantum readiness is becoming an identity governance problem
