Topic starter
07/11/2026 11:48 am
TL;DR: Post-quantum readiness, according to AppViewX’s analysis, depends on cryptographic posture management that ties each dependency to an owner and a change path. For practitioners, the issue is whether discovery, prioritisation and verification work together before vulnerable cryptography becomes a forced migration.
Editorial analysis by NHI Mgmt Group, based on content published by AppViewX: “The Quantum Readiness Gap: Why Post-Quantum Resilience Starts with Cryptographic Posture Management”.
By the numbers:
- RSA and elliptic-curve cryptography will be deprecated after 2030 and disallowed after 2035, according to AppViewX.
Key questions
Q: Why do cryptographic inventories become unreliable so quickly?
A: Cryptographic inventories become unreliable quickly because keys, certificates, algorithms, usages and owners change faster than manual records do.
Q: What is the difference between a cryptographic bill of materials and posture management?
A: A cryptographic bill of materials is a catalogue of the cryptographic components used by an application or service, such as algorithms, libraries, keys, certificates and protocols.
Q: Why does post-quantum cryptography change certificate management operations?
A: Post-quantum cryptography changes certificate management because the new signatures are much larger, so handshake overhead, logging, and validation design all become operational concerns.
Practitioner guidance
- Establish a live cryptographic dependency inventory Map certificates, libraries, signed connections and code-level cryptographic use to the service, data and owner they affect, then keep the inventory updated as deployments change.
- Separate exposure horizon from replacement effort Rank cryptographic dependencies by how long the protected data must stay trustworthy and how difficult the replacement path will be, then sequence work accordingly.
- Require pilot evidence before declaring crypto-agility Verify that new certificates, chains or algorithms work through discovery, test deployment and production-like validation before rollout is marked complete.
Bottom line: Post-quantum readiness is fundamentally an ownership and dependency problem, not just an algorithm migration problem.
Glossary terms: Post-Quantum Cryptography, Signed Token, Cryptographic Bill of Materials, Crypto-Agility
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
07/11/2026 11:48 am
Cryptographic posture management is the ownership model post-quantum programmes need. The hard part is not replacing an algorithm in isolation, but assigning accountability for every dependency that uses it across infrastructure, applications and suppliers. That makes posture management a governance discipline, not a tooling feature. The implication is that readiness must be measured by ownership clarity as much as by technical migration progress.
A few things that frame the scale:
- According to the 2023 State of Machine Identity Management report, only 47% of companies have enough staff dedicated to their PKI.
A question worth separating out:
Q: How should security teams prioritise cryptographic changes as quantum computing risk increases?
A: Security teams should start with the controls that protect communications first, especially key exchange, because those algorithms create the encrypted channel. Then they should plan for quantum-safe signatures and staged migration across systems that depend on SSH keys and certificates. A practical crypto-agility journey uses evaluation, adoption, and migration so organisations can reduce exposure without breaking connectivity.
👉 Read our full editorial: Cryptographic posture management makes quantum readiness accountable