Module 1 The Quantum Threat: Beyond the Headlines

The Foundation course introduces the quantum threat conceptually. You go deeper here. You learn how Shor’s algorithm breaks RSA and ECC, what resource estimates tell us about CRQC timelines, and how far error correction has progressed. You also learn to build a defensible timeline assessment from the evidence, without relying on vendor predictions or media narratives. You will examine the HNDL (harvest-now-decrypt-later) and TNFL (trust-now-forge-later) threat models in technical detail and learn to assess which of your organization’s assets are exposed to each.

Module 2 PQC Algorithm Assessment: NIST and Beyond

A rigorous evaluation of the three finalized NIST standards: ML-KEM, ML-DSA, and SLH-DSA. The module also covers FN-DSA, which is still in standardization as FIPS 206, and HQC, which NIST selected for standardization in 2025. For each algorithm, you examine the underlying mathematical problem and its performance: key generation, encapsulation and decapsulation, or signing and verification times. You also examine key and ciphertext or signature sizes, how security levels map to NIST categories, and known implementation considerations. You then learn to select the right algorithm for a specific deployment context. That includes when ML-KEM is the default choice and when SLH-DSA’s conservative security assumptions justify its larger signatures. It also includes when FN-DSA’s compact signatures matter, and where HQC adds useful diversity against lattice-based risk. You also look beyond NIST, at the post-quantum algorithms other countries and standards bodies are selecting or recommending. You learn what their choices mean for organizations that operate in several jurisdictions.

Module 3 Cryptographic Inventory and CBOM

The work every migration depends on: finding every place your environment uses cryptography. Structured discovery methodology across application code, TLS/SSH/IPsec configurations, certificate deployments, key management infrastructure, database encryption, file and disk encryption, hardware security modules, and third-party services. You will learn to build a CBOM in standardized formats and to automate discovery where tooling exists. You will also handle the gaps where it does not, and score each asset with a risk-weighted model to decide the migration order.

Module 4 Hybrid Implementations

Hybrid cryptography uses classical and post-quantum algorithms together, and it is the most widely recommended transition approach. BSI and ANSSI recommend hybrid deployment, and NIST permits it. The UK NCSC treats it as a pragmatic interim step with a planned exit to pure PQC. You cover how hybrid key exchange works in TLS 1.3, with both the concatenation and combiner approaches, and how hybrid signatures can be constructed. You also cover the performance and bandwidth implications, fallback and negotiation, and what “hybrid exit” involves once confidence in post-quantum algorithms is established. Hands-on exercises include configuring hybrid TLS with open-source libraries.

Module 5 Protocol Migration Assessment

Each protocol presents different migration challenges. TLS 1.3 has the most mature PQC support (ML-KEM hybrid key exchange is already deployed at scale). SSH requires key exchange and host key migration. IPsec migration involves IKEv2 integration and performance considerations. S/MIME and email encryption involve certificate chain changes and legacy client compatibility. Code signing involves long-lived trust anchors. PKI migration is an entire discipline (covered in depth in the advanced PKI course). Here you build the assessment framework. For each protocol in your environment, you identify the required changes, the options available today, and a sensible migration sequence.

Module 6 Migration Planning and Prioritization

Turning the inventory into a roadmap. Risk-based prioritization: which assets migrate first and why. Phased approaches, from quick wins to long-term architectural changes. Pilot program design, testing and validation strategies, rollback planning, and stakeholder communication. Vendor and supply chain considerations, including what to do when your migration timeline depends on a vendor who has not yet shipped PQC support. You will develop a migration roadmap for a realistic scenario as a course exercise.

Module 7 Running the Migration: Project, Change and Vendor Management

Organizations take years to complete a PQC migration, and the work involves teams far beyond security. You learn the management basics a specialist needs to contribute to that program. PQCM Manager Training covers the same topics in depth for the people who lead it.

• Project management. You break the roadmap into workstreams, milestones and dependencies. You estimate effort from the inventory and report progress in measures a program office can track.
• Technical change management. You take cryptographic changes through change control, with test plans, staged rollouts, maintenance windows, certificate rotation schedules and rollback criteria.
• Organizational change management. You identify the system owners, developers and operations teams each change affects, and plan what each group needs to know and when.
• Vendor management. You assess supplier PQC roadmaps and request cryptographic disclosures such as a CBOM. You also add quantum-safe requirements to procurement and contract renewals, and plan around vendors who have not yet shipped PQC support.

As a course exercise, you turn your Module 6 roadmap into a project plan with owners, change windows and vendor dependencies.

Module 8 Cryptographic Agility

The PQC migration will not be the last cryptographic transition. Designing systems that can change algorithms with bounded effort: agility at the application layer, protocol layer, and infrastructure layer. You will examine which architecture patterns achieve agility and which only claim it. You will also learn how to test agility in practice and how it relates to ongoing compliance and risk management. You finish with a self-assessment: how agile are the systems you work with today, and what would it take to improve them?