Find every place you use cryptography
Every PQC migration starts with discovery. You have to find every place cryptography is used: application code, TLS and SSH configurations, certificate stores, key management systems, databases, file systems, hardware security modules, and third-party services. The result is a Cryptographic Bill of Materials (CBOM), a complete, prioritized inventory that you base every later migration decision on.
This course teaches discovery methodology in depth. You learn the tools that automate parts of the process and the manual techniques for the parts that cannot be automated. You also learn a risk-weighted scoring model for turning a raw inventory into a migration sequence.
Course Outline
Module 1 Discovery Methodology
A structured approach to finding cryptography across the enterprise. Source code scanning for cryptographic API calls. Network scanning for TLS/SSH endpoints and their cipher suites. Certificate discovery across internal and external PKI. Configuration analysis for IPsec, S/MIME, and application-layer encryption. The discovery challenge in legacy systems, embedded devices, and third-party services.
Module 2 Tooling and Automation
The tools that automate cryptographic discovery and their limitations. CBOM generation tools and standardized formats (CycloneDX cryptography extensions). Integrating discovery into CI/CD pipelines. Where automation works well and where manual analysis remains necessary. Building a discovery process you can repeat after the first scan.
Module 3 Building the CBOM
Structuring a Cryptographic Bill of Materials. What to capture for each cryptographic asset: algorithm, key length, purpose, location, dependencies, and ownership. Mapping cryptographic assets to business systems and data flows. Handling the third-party dependency problem: cryptography you depend on but do not control.
Module 4 Prioritization and Scoring
Turning the inventory into a migration sequence. Risk-weighted scoring: quantum vulnerability, data sensitivity, exposure window, business criticality, and migration complexity. The HNDL lens: which assets protect data with long confidentiality requirements. Building a prioritized migration roadmap from the scored CBOM.
Prerequisites
A working understanding of PQC fundamentals is recommended. Consider Post-Quantum Foundation or PQCS certification for background.
Certificate of Completion
Upon completion, you receive a Quantum Academy certificate of completion. It is separate from our professional certifications and states your CPE credits, one for each 60 minutes of teaching. CISSP, CISM and CISA holders can claim them with their certifying body. The credits also count toward renewing a Quantum Academy certification. Our CPE credits page explains how to claim them.
Who this course is for
Security engineers, security architects, IT asset management professionals, and anyone tasked with leading or conducting cryptographic discovery for PQC migration.
What you’ll be able to do afterward
- Conduct systematic cryptographic discovery using automated scanning, manual assessment, vendor interrogation, and code analysis
- Build a Cryptographic Bill of Materials (CBOM) using the established data model
- Integrate cryptographic discovery with software composition analysis (SCA) and SBOM processes
- Select and configure discovery tooling for different environment types
- Maintain a living cryptographic inventory as systems change
- Avoid the common failure mode where discovery becomes a perpetual activity that never produces actionable results
What you leave with
When you finish, we email you the course handbook, a PDF of every slide with notes that explain it in full. We also include a PDF copy of Quantum Ready. The handbook is yours to keep.
Enrollment includes 180 days of access to the online on-demand course. Where that course is not yet published, the 180 days start on the day it is.
Where this course fits
Post-Quantum Foundation or PQCS Specialist Training provides the background for this course. You can take this course without either. PQC Migration: Executing the Waves covers the migration work that follows discovery. PQC Migration Project Management is for whoever will run that work.
Why we teach this
The course is built on the Applied Quantum PQC Migration Framework. Its author, Marin Ivezic, is one of the practitioners who teach here. The framework is published openly under Creative Commons at pqcframework.org. The people who teach this course run migration programs inside organizations today. The course covers the problems they meet in that work.
About this program
Quantum Academy credentials are private professional credentials issued by Quantum Academy, a trade name of Post-Quantum Institute. They are not government-issued licenses, accredited degrees, or academic credit, and earning one does not guarantee employment, promotion, regulatory approval, or any other specific outcome.
Quantum Academy programs are educational and informational only, and are not legal, compliance, or engineering advice.
