Post-Quantum Readiness: Building a Cryptographic Inventory of Your Enterprise Infrastructure

The first step in any PQC migration is knowing where vulnerable cryptography exists in your infrastructure. Most enterprises are shocked by the results — RSA and ECC are embedded in hundreds of systems, many of them critical. A cryptographic inventory is the foundation of your migration plan.

What to Inventory

Network Layer

• TLS certificates — every endpoint (external, internal, IoT)
• VPN tunnels — IPsec and WireGuard key exchange algorithms
• SSH keys — server and user authentication keys
• DNS — DNSSEC signing algorithms

Application Layer

• Code signing certificates — software distribution, container image signing
• API authentication — JWT signing algorithms, OAuth token signing
• Document signing — PDF signatures, XML signatures, S/MIME email
• Database encryption — TDE keys, column-level encryption

Infrastructure Layer

• HSM inventory — which algorithms are used, firmware PQC readiness
• Key management systems — algorithms for key wrapping and transport
• Backup encryption — encryption algorithms protecting backup archives
• Boot security — Secure Boot signatures, firmware signing

Automated Discovery Tools

• Network scanning — TLS endpoint scanning (testssl.sh, sslyze) for protocol and cipher audit
• Code scanning — Static analysis for cryptographic API usage (CryptoSense, Semgrep rules)
• Cloud configuration — Cloud provider APIs to enumerate encryption configurations
• Certificate transparency — CT log monitoring for your domains

Risk Classification

Classify each cryptographic use by quantum risk:

• Critical — Protects data with 10+ year confidentiality requirement (healthcare records, state secrets, financial archives). Migrate to hybrid PQC immediately
• High — Protects data with 5-10 year confidentiality. Plan migration within 2 years
• Medium — Ephemeral key exchange (TLS sessions). Lower harvest risk but high volume. Migrate when ecosystem support is available
• Low — Authentication-only use (signatures verified in real-time). Migrate when PQC signatures are widely supported

Crypto Agility

The most important outcome of the inventory: identify systems that are NOT crypto-agile — hardcoded algorithms, embedded certificates, systems that can't be updated. These are your biggest migration risks. Prioritize making them agile before the full PQC migration.