What Larger Keys Do to Your Network
A hybrid TLS handshake carries about 1,216 bytes where a classical one carried 32. We count the whole first flight and follow it across…
Harvest Now, Decrypt Later: Which Data Is Actually at Risk
HNDL is not a threat you defend against everywhere at once. It has a scope, and the scope is narrower than most briefings suggest.…
SBOM, CBOM, and the Rest of the Alphabet
Four bills of materials, four different questions. What each one answers, what belongs in a CBOM, and how to scope the work without stalling…
Getting Vendors to Answer the Right Questions
Most post-quantum vendor questionnaires ask about intent, and intent questions have one correct answer that every vendor knows. Four question shapes that don't.
Crypto-Agility in Practice: A Design Guide for Architects
Crypto-agility is measured in how long a substitution takes and how much of the system it touches. Here is what that means at the…
Five Ways Post-Quantum Migration Programs Fail
Most post-quantum migration programs stall at the seams: certificate profiles, network paths, HSM limits, inventory gaps, and work nobody owns. Five failure modes, and…
Cryptographic Inventory: What Works, What Fails, and Why
A practical guide to running a cryptographic inventory that survives contact with a real environment: what interviews are good for, what tooling catches, and…
Planning the First Year of a Post-Quantum Program
Twelve months will not migrate an enterprise off RSA. It will produce an inventory, a working lab, a PKI that can issue post-quantum credentials,…
FIPS 140 and What Validation Actually Certifies
A FIPS 140 certificate names one module, one version, one tested environment and one mode of operation. Here is how to read one, and…
Q-Day and Y2K: What the Comparison Gets Right
The Y2K analogy is useful for justifying the budget and misleading about the schedule. Here is which half of it to keep.