Executive summary
Quantum computing will not simply introduce a new algorithm choice; it will force enterprises to re-engineer how cryptography is discovered, governed, migrated and continuously monitored. Traditional PKI remains the foundation of digital trust, but it must evolve into PQC-enabled, crypto-agile infrastructure. Organizations should begin with visibility, build a Cryptographic Bill of Materials (CBOM), prioritize high-risk use cases and then execute controlled hybrid and PQC migration waves across certificates, TLS, signing, key management and dependent applications.
The coming cryptographic disruption
For decades, Public Key Infrastructure (PKI) has provided the trust fabric for enterprise security: TLS communications, digital certificates, identity platforms, application authentication, code signing and secure business transactions. That trust fabric is now entering a major transition. Large-scale quantum computers, when available, may weaken widely used public-key algorithms such as RSA and elliptic-curve cryptography (ECC). As a result, enterprises must prepare before the risk becomes operationally urgent.
The shift from PKI to Post-Quantum Cryptography (PQC) is not a single technology upgrade. It is a strategic crypto transformation program that touches architecture, compliance, vendors, lifecycle operations, asset inventories and business-critical applications.
Why enterprises must act now
Harvest now, decrypt later risk: Sensitive encrypted data can be captured today and retained for future decryption. Long-lived data such as financial records, intellectual property, regulated data and confidential business information require early protection planning.
Cryptography is everywhere: Crypto is embedded across applications, devices, cloud platforms, APIs, databases, networks, IoT, firmware and third-party products. Without discovery, enterprises cannot determine migration scope.
Standards are now available: NIST finalized its first three PQC standards in 2024: ML-KEM for key establishment, ML-DSA for digital signatures and SLH-DSA for stateless hash-based signatures.
Migration will take years: Enterprise crypto modernization requires sequencing, compatibility testing, vendor readiness checks, policy updates and phased cutovers. Starting early reduces business disruption.
PKI today vs. PQC-enabled PKI tomorrow
| Area | Traditional PKI | PQC-enabled PKI | Enterprise implication |
| Algorithms | RSA, ECC, classical key exchange and signatures | ML-KEM, ML-DSA, SLH-DSA and hybrid modes | Update crypto policies and approved algorithm catalogs |
| Security model | Based on classical computing assumptions | Designed to withstand quantum attack models | Prioritize systems with long data confidentiality lifetimes |
| Architecture | Static and application-specific crypto implementations | Crypto-agile and policy-driven architecture | Decouple applications from hard-coded algorithms |
| Operations | Manual inventories and fragmented ownership | Central CBOM, ownership, lifecycle and risk governance | Create crypto asset governance and audit-ready reporting |
| Migration approach | Periodic refresh or local upgrade | Programmatic, phased enterprise transformation | Adopt roadmap, governance and controlled migration waves |
The six-phase crypto transformation roadmap
| Phase | Objective | Key activities | Primary outputs |
| 1. Mobilize | Create the quantum readiness program, define governance, appoint crypto owners and align security, infrastructure, application, compliance and procurement teams. | Program charter, governance model, stakeholder RACI | Program charter |
| 2. Discover | Identify certificates, keys, algorithms, protocols and crypto libraries across applications, endpoints, cloud services, HSM/KMS, APIs and third-party platforms. | Crypto discovery report, initial asset map | Crypto discovery report |
| 3. Build CBOM and risk baseline | Create a Cryptographic Bill of Materials and classify assets by algorithm, usage, owner, business criticality, data sensitivity and data lifespan. | CBOM, risk register, heatmap | CBOM |
| 4. Design crypto-agile target state | Define PQC and hybrid strategies, policy controls, integration patterns, vendor readiness requirements and lifecycle governance workflows. | Target architecture, policy framework, vendor dependency tracker | Target architecture |
| 5. Migrate in controlled waves | Start with high-risk and high-value use cases such as external TLS, code signing, VPN, PKI hierarchy, signing services, high-value applications and long-lived data protection. | Migration backlog, test results, phased deployment plan | Migration backlog |
| 6. Monitor and evolve | Operate PQC as a continuous lifecycle capability with dashboards, posture monitoring, algorithm updates, compliance reporting and exception management. | Operational dashboards, SLA/KRI reports, audit evidence pack | Operational dashboards |
Priority enterprise use cases
- TLS and external-facing services: Hybrid key exchange and secure connectivity for customer-facing services.
- Enterprise PKI and certificate lifecycle: Modernize CA hierarchy, certificate profiles, issuance workflows and CLM integrations.
- Code signing and firmware signing: Protect software supply chain trust with PQC-ready signing strategy and stronger governance.
- VPN, remote access and secure tunnels: Assess protocol and product readiness for quantum-safe key establishment.
- HSM, KMS and key lifecycle governance: Map key ownership, usage, rotation, archival and destruction controls across platforms.
- Long-lived sensitive data: Prioritize data requiring confidentiality beyond the expected quantum risk horizon.
Key challenges and recommended mitigations
| Challenge | Why it matters | Mitigation |
| Scale and complexity | Crypto is distributed across thousands of assets and unmanaged dependencies. | Use automated discovery, CBOM and risk-based prioritization. |
| Legacy constraints | Older applications, libraries and appliances may not support PQC or hybrid modes. | Create remediation patterns: upgrade, replace, isolate or compensate. |
| Vendor readiness | Enterprise products depend on OEM roadmaps and validated implementations. | Add PQC readiness questions into procurement and renewals. |
| Performance and interoperability | PQC algorithms can affect handshake size, latency and compatibility. | Run pilots, lab testing and phased production rollouts. |
| Governance gaps | Manual tracking leads to incomplete ownership, weak auditability and inconsistent action. | Establish ServiceNow/CMDB-backed crypto governance integrated with HSM, KMS and CLM tools. |
HCLTech point of view
- Enterprises should treat PQC as a business resilience and governance program, not only as a cryptographic algorithm change.
- The first priority is visibility: without a trusted CBOM, organizations cannot quantify exposure, prioritize migration or demonstrate progress to auditors and leadership.
- PKI should evolve into a PQC-enabled trust platform with crypto-agility, automated certificate lifecycle management, HSM/KMS governance and integration with ITSM workflows.
- Hybrid cryptography will be an important bridge where standards, products and interoperability mature at different speeds across the enterprise ecosystem.
Conclusion: Modernize trust before quantum becomes an emergency
The future is not about replacing PKI; it is about modernizing PKI into a quantum-safe, crypto-agile trust architecture. Enterprises that start early can reduce long-term risk, avoid rushed compliance-driven remediation and create lasting operational maturity across cryptographic assets.
Final thought: The key question is no longer whether quantum computing will challenge today’s cryptography. The key question is whether the enterprise will have the visibility, governance and agility to respond before that risk becomes business-critical.
References and further reading
