Security teams often state “everywhere” when asked to pinpoint where vulnerable cryptography resides within their systems, a reality encompassing certificates, keys and vendor products, but few organizations currently possess a detailed map of this widespread exposure.
Keyfactor is addressing this challenge with Stage 2 of post-quantum cryptography (PQC) readiness, focusing on discovery and planning to build a roadmap for migration, because, as the company emphasizes, “You can’t migrate what you can’t see.” This stage expands initial efforts by asking four concrete questions: location of vulnerable cryptography, key stakeholders and critical dependencies, to establish a fact-based baseline for future decisions.
Discovery as Foundation for PQC Migration Planning
Organizations grappling with the transition to cryptography frequently report a lack of visibility into where vulnerable systems reside, often stating that such cryptography is present “everywhere” within their infrastructure. This widespread distribution extends to certificates, keys, libraries, devices and the products offered by third-party vendors, creating a significant challenge for effective migration planning. While initial efforts, categorized as Stage 1, focused on broad awareness and alignment, cryptographic discovery began in only select locations, leaving most organizations without a complete inventory of at-risk systems.
Who needs to be involved? Which dependencies can affect the execution and delivery of your plans? A Keyfactor PQC expert can assist organizations in connecting these results to their specific environments, offering guidance on discovery, prioritization, testing and migration strategies. This process builds a clear picture, and the goal is a fact-based baseline you can act on, so every later decision starts from evidence.
Mapping Quantum Vulnerable RSA and ECC Algorithms
Organizations often underestimate the breadth of their exposure to quantum-computing threats, with many unable to comprehensively list where vulnerable cryptographic systems reside within their infrastructure. While awareness of the need for post-quantum cryptography (PQC) has grown, translating that awareness into a detailed inventory remains a significant hurdle; the widespread use of RSA and elliptic curve cryptography (ECC) means these algorithms can persist in overlooked systems and components for years.
Particular attention should be given to keys stored in hardware security modules (HSMs) and cloud key management services, as their readiness directly impacts an organization’s migration timeline. Identifying these dependencies is the core of Stage 2 PQC readiness, a phase focused on discovery and planning, and moves organizations beyond broad awareness towards a fact-based understanding of their quantum vulnerabilities.
Common locations for vulnerable cryptography include public and private TLS certificates on web servers, load balancers and APIs, as well as internal public key infrastructure (PKI) encompassing root and issuing certificate authorities, Keyfactor says. Secure Shell (SSH) keys used by administrators and automation, code signing and firmware signing keys also require assessment, alongside VPN gateways and remote access tools. Third-party and open-source libraries bundled into applications, and embedded/Internet of Things (IoT) devices with long service lives, represent further areas of potential risk.
To accelerate the discovery process, organizations should consistently question vendors about their PQC roadmaps and support, according to Keyfactor. Specifically, asking which algorithms and key sizes a product uses, and where those are implemented, provides a baseline for comparison and helps to validate readiness. A critical question for assessing vendor preparedness is, “Which algorithms and key sizes does your product use today, and where in the product are they being used?”
Progressing Cryptographic Visibility: From Limited to Validated
Moving beyond initial awareness, organizations now commonly find themselves in a phase of largely manual cryptographic discovery, coordinating efforts with dedicated teams and secured funding. This progression into Stage 2 signifies a shift from broad acknowledgement of the post-quantum threat to active mapping of cryptographic dependencies within their environments. The initial focus of this discovery typically centers on high-value or high-risk systems, prioritizing sensitive data and components facing regulatory scrutiny to quickly surface critical findings.
A validated view of cryptographic exposure, however, requires more than simply identifying systems. It demands a clear understanding of the external factors influencing migration timelines. Organizations are now actively charting the relationships between vendors, hardware, software and services, recognizing that dependencies outside of direct control will dictate the pace of their post-quantum transition. This detailed dependency mapping reveals where timing may be constrained, and accounts for lead times needed for updates or replacements.
Automated Discovery for Continuous PQC Observability
Automated discovery moves beyond initial cryptographic inventories, focusing on the dynamic nature of modern systems; manual tracking methods quickly become unsustainable when facing environments that change daily with new services, certificates and libraries. While manual spot checks offer a starting point, they cannot scale to organizations managing thousands or millions of assets, necessitating automated tools for regular flagging of new or altered cryptographic usage.
Keyfactor AgileSec, for example, provides continuous discovery across network endpoints, hosts, source code, artifact repositories and key/certificate management systems, the firm reports. The ultimate aim extends beyond a simple inventory to continuous observability, integrating cryptographic data with existing change, asset, vulnerability and risk management processes. This level of integration isn’t immediately necessary in Stage 2, but understanding the end goal informs the selection of scalable discovery approaches.
Targeted discovery on high-value systems, those containing sensitive, long-lived, exposed, or regulated data, provides an early exposure assessment before expanding to full automated coverage. A mature cryptographic inventory, however, adds ownership, business context and dependency mapping to prioritize systems effectively. Establishing a baseline for post-quantum readiness requires assessing six interconnected areas: cryptographic observability, risk prioritization, ecosystem readiness, testing and transition and operational governance.
Measuring these areas is critical because they are mutually dependent; a comprehensive baseline reveals how prepared an organization is to act on its cryptographic inventory. According to the documentation, “Knowing where you’re headed helps you choose discovery approaches that will scale when you move to automating cryptographic operations.” This forward-looking approach also supports continuous resilience, enabling algorithm changes without disruption, a capability increasingly vital as the quantum threat evolves.
The scope of discovery must extend beyond internal systems to encompass external dependencies. Migration timelines are heavily influenced by vendors, third-party platforms, hardware, software and services all containing cryptography outside of direct organizational control. Understanding these dependencies is essential for accurately assessing potential constraints and planning a realistic migration path. The Keyfactor PQC Lab offers resources to aid in this process, including tools for cryptographic inventory and a PQC readiness assessment.
Vendor Dependencies and PQC Roadmap Validation
Mapping these dependencies reveals where migration timing resides outside of an organization’s direct control, necessitating proactive engagement with suppliers. Stage 2 readiness involves identifying critical dependencies and requesting PQC roadmaps and support information from vendors, a process that should be integrated into procurement and renewal language. Consistent questioning of vendors is key to comparing responses and gaining a validated view of their PQC plans. Folding these questions into contracts ensures that each new agreement contributes to a comprehensive dependency map.
Establishing clear criteria for prioritization is also central to Stage 2, enabling a consistent and defensible ranking of migration efforts. Organizations should base these criteria on factors including data sensitivity, the duration data must remain confidential, exposure to harvest now, decrypt later attacks, business criticality, regulatory obligations and migration complexity. Data longevity, in particular, warrants close examination, as long-lived data is at greater risk from future quantum computers.
When organizations are prepared for hands-on tools, resources like the PQC Lab can aid in the process, providing support for cryptographic inventory and migration planning. A clear picture of current cryptographic usage, dependencies, and prioritized criteria forms the foundation of a realistic migration plan, resting on evidence rather than assumptions.
See today’s quantum computing news on Quantum Zeitgeist for the latest breakthroughs in qubits, hardware, algorithms, and industry deals.
