Integrate PQC into CI/CD Pipelines
Organizations that practice DevSecOps need to build PQC migration into the development pipeline itself. This course covers integrating cryptographic migration into CI/CD: scanning for cryptographic dependencies, testing post-quantum implementations in staging, managing certificates and keys for dual-stack deployments, and handling container and Kubernetes considerations.
Course Outline
Module 1 Cryptographic Dependency Scanning in CI/CD
Integrating cryptographic discovery into the development pipeline. Scanning code and dependencies for cryptographic usage. Automated CBOM generation in CI/CD. Failing builds on policy violations. Tracking cryptographic debt as code.
Module 2 Testing PQC in the Pipeline
Post-quantum testing in staging environments. Automated testing for hybrid implementations. Performance regression testing for cryptographic changes. Interoperability testing in CI/CD. Negative testing for downgrade prevention.
Module 3 Key and Certificate Management for Dual-Stack
Managing certificates and keys for dual-algorithm deployments. Secrets management for PQC. Automating certificate provisioning for dual-stack. Key rotation in agile pipelines.
Module 4 Container and Kubernetes Considerations
PQC in containerized environments. Service mesh cryptographic migration. mTLS with post-quantum algorithms in Kubernetes. Image signing with post-quantum signatures. Managing cryptographic configuration across container orchestration.
Prerequisites
A working understanding of PQC fundamentals is recommended. Consider Post-Quantum Foundation or PQCS certification for background.
Certificate of Completion
Upon completion, you receive a Quantum Academy certificate of completion. It is separate from our professional certifications and states your CPE credits, one for each 60 minutes of teaching. CISSP, CSSLP and CISM holders can claim them with their certifying body. The credits also count toward renewing a Quantum Academy certification. Our CPE credits page explains how to claim them.
Who this course is for
Platform and DevSecOps engineers, CI/CD owners, and application security teams who will have to make cryptographic change a routine operation. Familiarity with pipeline tooling is assumed.
If you are planning a migration program, PQC Migration Project Management is a better fit.
What you’ll be able to do afterward
- Integrate post-quantum checks into CI/CD and make cryptographic change a routine part of delivery
- Run cryptographic dependency scanning across repositories and build artifacts
- Stand up post-quantum testing in staging that catches breakage before production
- Automate certificate and key rotation paths that still work after an algorithm change
- Treat the pipeline itself as cryptographic estate, including signing and provenance
What you leave with
When you finish, we email you the course handbook, a PDF of every slide with notes that explain it in full. We also include a PDF copy of Quantum Ready. The handbook is yours to keep.
Enrollment includes 180 days of access to the online on-demand course. Where that course is not yet published, the 180 days start on the day it is.
Where this course fits
Post-Quantum Foundation or PQCS Specialist Training provides the background for this course. You can take this course without either. Cryptographic Agility covers the design principles. Cryptographic Discovery, Inventory, and CBOM covers the inventory your pipelines should enforce.
Why we teach this
The course is built on the Applied Quantum PQC Migration Framework. Its author, Marin Ivezic, is one of the practitioners who teach here. The framework is published openly under Creative Commons at pqcframework.org. The people who teach this course run migration programs inside organizations today. The course covers the problems they meet in that work.
About this program
Quantum Academy credentials are private professional credentials issued by Quantum Academy, a trade name of Post-Quantum Institute. They are not government-issued licenses, accredited degrees, or academic credit, and earning one does not guarantee employment, promotion, regulatory approval, or any other specific outcome.
Quantum Academy programs are educational and informational only, and are not legal, compliance, or engineering advice.
