Retiring SHA-1 Took More Than a Decade: Lessons for Post-Quantum Planning
Retiring SHA-1 took the public web almost 12 years, and NIST's end date for every use is December 31, 2030. Post-quantum planners can learn…
The Four Capabilities a PQC Program Needs
Most organizations don't need four post-quantum hires. They need four capabilities: discovery, architecture, implementation, and delivery. How those map to headcount depends on the…
Building a Crypto Inventory That Covers the Whole Estate
Cryptography hides in places no network scanner reaches. A domain-by-domain guide to finding it, and to what every inventory record has to say once…
Third-Party Cryptographic Risk at Enterprise Scale
Regulators require an inventory of cryptography your suppliers are not obliged to disclose. Four governance artifacts that close the gap and keep third-party PQC…
Ethereum’s Five Quantum Vulnerabilities and Who Owns Each Fix
One network, three cryptographic primitives, five layers, five different sets of owners. Ethereum as a worked example in reading a cryptographic inventory.
The Two Dates in NIST IR 8547 That Govern Your Migration Plan
NIST IR 8547 is usually reduced to 2035. It sets two dates, and the earlier one is already shaping procurement and risk acceptance decisions.
How to Estimate Post-Quantum Migration Effort
Two planners can size the same estate at 2,000 tasks and 120,000. Here is the unit to count, the ratio that catches a bad…
Sequencing the Waves in a Post-Quantum Migration
Scope is not what sinks a post-quantum program. Order is. A practical guide to gates, dependencies, and how to cut a migration wave that…
What a CBOM Scoping Exercise Finds Inside One Mobile Banking Payment
A payment from a phone crosses up to nine institutional boundaries. Only some of them are yours to inventory. Here is how a CBOM…
NIS2, DORA, and the Evidence a Supervisor Will Ask For
European post-quantum regulation rarely says "deploy PQC by date X." It says produce the file. Here is what that file contains, and what your…