The difficulty of locating all existing cryptographic assets is proving a major hurdle for organizations preparing for post-quantum cryptography, according to a new report. Frost & Sullivan’s “Insights for CISOs: Transition to Quantum-Safe” identifies that these assets are scattered across networks, applications, source code and even hardware security modules, creating a fragmented and complex inventory challenge.
Encryption Consulting’s CBOM Secure platform is highlighted within the report as a solution, turning cryptographic visibility into actionable migration plans. “Every post-quantum roadmap starts with the same question: what cryptography do we have, and what depends on it?” says Puneet Singh, Principal at Encryption Consulting.
Frost & Sullivan Highlights Cryptographic Visibility for PQC Migration
The Frost & Sullivan report, “Insights for CISOs: Transition to Quantum-Safe,” details how organizations are discovering that locating all cryptographic assets is proving more difficult than initially projected, a challenge that extends beyond simply identifying algorithms in use. Effective cryptographic inventories must now map dependencies between those assets and the applications, data, and business processes that rely on them, adding a layer of complexity few anticipated.
This discovery phase is critical because, according to the report, a complete understanding of an organization’s cryptographic footprint is the essential first step toward mitigating the risks posed by quantum computing. Cryptographic assets are not confined to a single location. Instead, they are scattered across diverse IT infrastructure components including networks, endpoints, applications, source code, certificates, key management systems and hardware security modules (HSMs). This fragmentation necessitates a comprehensive approach to discovery, one that moves beyond traditional asset management tools.
Encryption Consulting’s CBOM Secure platform addresses this challenge by employing over 20 sensors to scan these varied environments, creating a unified inventory of an organization’s cryptographic landscape, the company says. The platform then maps the relationships between these assets, including certificate-key links and cross-service dependencies, to provide a clear view of cryptographic exposure.
The ability to translate this visibility into actionable plans is a key differentiator, according to Özgün Pelit, Senior Industry Analyst at Frost & Sullivan. “Encryption Consulting brings together deep cryptographic expertise, comprehensive discovery capabilities, and practical implementation support to address the complexities of PQC migration,” Pelit said.
“Its CBOM Secure platform stands out for its broad visibility into cryptographic assets and dependencies, combined with contextual risk prioritization that helps organizations translate discovery findings into actionable migration roadmaps.” The platform’s integration with existing enterprise security workflows, such as ServiceNow, and endpoint security platforms like Tanium and CrowdStrike, further streamlines the migration process.
Puneet Singh, Principal at Encryption Consulting, emphasizes the fundamental question driving PQC migration efforts. “We built CBOM Secure to answer that question across the places cryptography actually lives, from cloud key management and HSMs to databases and source code, and to turn the answer into a prioritized plan.” Singh notes that organizations prioritizing visibility now, beginning with a focused perimeter, are the ones successfully moving from assessment to execution.
The urgency to establish this visibility is highlighted by the timelines set by leading technology companies and regulatory bodies. Google’s commitment to a full transition to PQC by 2029, and the PQC milestones established by regulators in the United States, the European Union and other nations, are driving organizations to accelerate their migration plans. Financial institutions, in particular, are facing increased scrutiny and are expected to demonstrate progress in identifying cryptographic assets and developing migration strategies.
Frost & Sullivan’s report also suggests a growing awareness of PQC maturity among private equity investors, who are beginning to factor it into due diligence assessments, potentially impacting company valuations. The report advises security leaders to adopt a phased approach, starting with a focused perimeter rather than attempting a complete enterprise-wide inventory.
It also recommends integrating PQC capabilities with existing security platforms to avoid creating isolated tools and using early pilot programs to build accurate bills of materials and cost estimates for wider investment. Cryptographic visibility is a strategic imperative for organizations preparing for the quantum era.
Every post-quantum roadmap starts with the same question: what cryptography do we have, and what depends on it?
Puneet Singh, Principal at Encryption Consulting
See today’s quantum computing news on Quantum Zeitgeist for the latest breakthroughs in qubits, hardware, algorithms, and industry deals.
