Topic starter
25/06/2026 10:47 pm
TL;DR: Forty-eight percent of organisations say they are not prepared for post-quantum cryptography, while only 28% have both budget and personnel committed to readiness, according to a Keyfactor survey of 450 security professionals across North America and Europe. The issue is less about algorithms than about governance, inventory, and ownership across identity-linked cryptographic assets.
Editorial analysis by NHI Mgmt Group, based on content published by Keyfactor: “Inside the First Issue of Digital Trust Digest”.
Key questions
Q: What is the biggest failure mode in PQC readiness programmes?
A: The biggest failure mode is treating PQC as a future crypto swap instead of a governed inventory and ownership problem.
Q: Why does PQC readiness depend so heavily on governance?
A: Because PQC affects many teams at once, including PKI, application owners, security architecture, procurement, and executive budget holders.
Q: How can security teams tell whether PQC visibility is real?
A: Visibility is real only when cryptographic assets are actively monitored and tied to business services, not when a survey answer says teams know where things are.
Practitioner guidance
- Build a cryptographic asset inventory Identify certificates, keys, and cryptographic dependencies across applications, infrastructure, and identity services before selecting migration targets.
- Assign named PQC ownership Give one accountable owner per system or trust domain so readiness work does not stall between PKI, security, application, and executive teams.
- Separate funded work from unfunded intent Translate readiness into a resourced programme with staffing, milestones, and executive sponsorship rather than waiting for a future mandate.
Bottom line: PQC readiness is being slowed less by algorithm uncertainty than by weak governance over ownership, inventory, and monitoring.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 11:28 pm
PQC readiness is an identity governance problem before it is a cryptography problem. The article shows that organisations are not failing because the algorithms are unavailable, but because ownership, funding, and monitoring are not aligned. That pattern matters to IAM and PKI teams because cryptographic assets sit inside the same governance structures that manage access, trust, and lifecycle. The practitioner conclusion is that readiness must be governed as an operating model, not a one-time technical upgrade.
A question worth separating out:
Q: Should organisations wait for regulator pressure before funding PQC work?
A: No. Waiting for external pressure usually means the programme starts too late and with too little flexibility. The article shows that many organisations are already underprepared, so deferring funding only increases the chance of rushed migrations, weak ownership, and missed dependencies when timelines tighten.
👉 Read our full editorial: Post-quantum cryptography readiness is lagging enterprise governance