Crypto-Agility When You Can’t Swap the Algorithm
Algorithm swaps almost never happen cleanly. A more useful definition of crypto-agility, and the four mitigation patterns architects can deploy before a full replacement…
Turning NIST SP 1800-38 Into a Governance Work Plan
NIST's practice guide on post-quantum migration is a lab record, not a mandate. A GRC reading of its three volumes, and the four artifacts…
Cryptographic Competence: What Your Engineers Need to Know
The post-quantum migration is an engineering problem, not a mathematics problem. Here is what competence looks like across the four domains that carry the…
Post-Quantum Cryptography in OT: Sort the Fleet Before You Plan the Migration
Most PQC migration advice assumes you can change the code that checks a signature. In OT you often can't. Sorting assets by verifier agility…
SBOM, CBOM, and the Rest of the Alphabet
Four bills of materials, four different questions. What each one answers, what belongs in a CBOM, and how to scope the work without stalling…
Getting Vendors to Answer the Right Questions
Most post-quantum vendor questionnaires ask about intent, and intent questions have one correct answer that every vendor knows. Four question shapes that don't.
Cryptographic Inventory: What Works, What Fails, and Why
A practical guide to running a cryptographic inventory that survives contact with a real environment: what interviews are good for, what tooling catches, and…
Planning the First Year of a Post-Quantum Program
Twelve months will not migrate an enterprise off RSA. It will produce an inventory, a working lab, a PKI that can issue post-quantum credentials,…
Finding the Assets Before You Find the Cryptography
Most cryptographic inventories stall at the asset layer, not the crypto layer. A sequencing guide for engineers working across mixed IT and OT estates.