Why PQC migration starts long before algorithm replacement

By Jean-Julien Alvado, CTO at Evertrust

Post-quantum cryptography is often framed as an algorithm problem.

Which algorithms will be standardized? Which ones will be adopted first? Which systems will need to change, and when?

These are valid questions. But they are not the best place to start.

Because in practice, post-quantum migration does not begin with algorithm replacement. It begins much earlier with visibility, governance, and the ability to evolve cryptography without losing control of the environment around it.

That is the part many organizations are now starting to discover.

The hardest part of the post-quantum transition will not be selecting new cryptographic primitives. It will be understanding where cryptography is used today, what depends on it, who owns it, and how to change it safely across a large, heterogeneous estate.

In other words, PQC migration is not only a cryptographic challenge. It is an operational one.

You cannot migrate what you cannot see

Every serious migration starts with one simple question: what do we actually have?

That question is much harder to answer than it should be.

In most organizations, cryptography is deeply embedded across infrastructure, applications, certificates, devices, APIs, identity systems, network components, software supply chains, and partner integrations. Some of it is visible and well-managed. Much of it is not.

Over time, environments accumulate:

•  legacy certificates that no one fully owns 
•  trust relationships that were documented once and never revisited 
•  hardcoded cryptographic dependencies 
•  applications built on assumptions that no longer reflect current policy 
•  manual processes that “work” until change is required at scale 

This is why the first phase of PQC preparation is not replacement. It is discovery. Organizations need to identify where cryptography is present, how it is used, what the dependency chain looks like, and which assets are likely to become blockers later. Without that baseline, migration planning remains theoretical.

And the bigger the environment, the more dangerous that blind spot becomes.

The real challenge is not the algorithm. It is the dependency map.

Replacing an algorithm in isolation is rarely the issue. The issue is everything connected to it. A certificate is not just a certificate. It is tied to applications, load balancers, operating systems, trust stores, hardware security modules, certificate authorities, internal policies, external partners, and renewal workflows. The same is true of keys, protocols, and identity systems more broadly.

That means PQC migration is less like a technical upgrade and more like an ecosystem change. The question is not simply, “Can this component support a post-quantum algorithm?”

The real questions are:

•  What else depends on this component? 
•  What breaks if it changes? 
•  What cannot change at the same speed? 
•  Where do we need hybrid approaches or transition periods? 
•  Which third parties will move slower than we do? 

This is why organizations that treat PQC as a future replacement project are likely to underestimate the effort involved. By the time algorithm replacement becomes urgent, the real work should already be underway.

Governance becomes a security control

Another misconception is that PQC migration is mostly a technical team issue. It is not. At scale, migration succeeds or fails based on governance.

-> Someone needs to define ownership.
-> Someone needs to set policy.
-> Someone needs to decide how risk is prioritized, how exceptions are handled, how dependencies are tracked, and how changes are validated across teams.

Without that governance layer, even technically sound migration plans can stall.

This is especially true in environments where responsibility for cryptography is fragmented across infrastructure, security, IAM, application teams, network teams, and external providers. In those cases, the problem is not lack of awareness. It is lack of coordination.

PQC raises the bar because it forces organizations to answer questions they have often postponed for years:

•  Who owns machine identity strategy? 
•  Where is certificate policy defined and enforced? 
•  How are cryptographic changes approved and tracked? 
•  How do we avoid creating new exceptions every time the environment evolves? 

This is why PQC migration should be viewed as a governance program as much as a technical roadmap.

Crypto-agility is the real long-term objective

The post-quantum transition matters. But the bigger lesson is broader than PQC itself. Cryptography will keep changing. Algorithms evolve. Standards evolve. Trust models evolve. Threat models evolve. Lifecycles shrink. Operational expectations increase. Organizations therefore should not aim only to “get through PQC.” They should aim to become more crypto-agile.

Crypto-agility is the ability to adapt cryptographic choices, policies, and trust operations over time without having to rebuild the organization every time something changes. 

That requires more than new cryptographic support. It requires:

•  continuous visibility into certificates, keys, and dependencies 
•  centralized governance and policy enforcement 
•  repeatable lifecycle processes 
•  automation where manual work would otherwise become a bottleneck 
•  an operating model designed for change, not just for maintenance 

This is why the work organizations do now, such as inventorying assets, rationalizing workflows, improving certificate lifecycle management, and clarifying ownership, is not separate from PQC migration. It is the foundation for it.

Final thoughts

Post-quantum migration is not a race to swap algorithms overnight. It is a long transition that will reward organizations with the strongest operational foundations.

Those foundations are built long before replacement begins.

They are built when teams improve visibility. When they govern trust more consistently. When they reduce manual dependencies.
When they stop treating cryptography as an isolated technical domain and start managing it as a living part of digital operations.

That is why PQC migration starts long before algorithm replacement and organizations that prepare now will be the ones best positioned to adapt, not only to post-quantum change, but to whatever comes after it.