The Real Size of a Post-Quantum Migration
One published program plan for a post-quantum migration runs to more than 120,000 scheduled tasks. Here is where the small estimate loses the work.
What a CBOM Scoping Exercise Finds Inside One Mobile Banking Payment
A payment from a phone crosses up to nine institutional boundaries. Only some of them are yours to inventory. Here is how a CBOM…
Rethinking the CBOM
Complete cryptographic inventory is a mirage. A Minimum Viable CBOM maps trust boundaries first, records what you don't know, and produces migration decisions instead…
Q-Day Is a Confidence Crisis, Not an Outage
The morning a quantum computer factors an RSA-2048 key, nothing goes dark. What ends is the presumption of safety, and the questions start within…
Trust Now, Forge Later: The Signature Half of the Migration
Harvest Now, Decrypt Later sets its clock by data retention. The signature side of the quantum problem sets its clock by deployment lifetime, and…
Quantum Readiness Is Not Only a Vendor Problem
Suppliers will ship post-quantum algorithms. The cryptographic inventory, the risk decisions and the contract terms are work no supplier can do on your behalf.
Mosca’s Theorem: Working Out Your Own Quantum Deadline
Mosca's Theorem is one line of arithmetic, and most organizations get two of its three variables wrong. Here is how to estimate each one…
The Deadlines That Already Bind Your Cryptography
Q-Day is a forecast and forecasts move. The 2028, 2030, 2031 and 2035 milestones published by NCSC, the EU, Canada and NIST are commitments…
When a Full Cryptographic Inventory Isn’t Possible
Enterprise-wide crypto discovery stalls in predictable places. Here is how to scope an inventory you can finish, and how to make the unexamined remainder…
Scoping a Quantum Readiness Assessment Around Four Decisions
Most guidance describes a quantum readiness assessment from the inventory up. Scoping it from the four decisions it has to unlock keeps it from…