The 90-Day Cryptographic Countdown: A Post-Mortem on One Enterprise's PQC Migration

When a reader we'll call "the platform lead" first wrote to us, the message was short: "Our auditors asked how many RSA-2048 certificates we had. It took three weeks to answer. We still aren't sure the number is right." That single sentence is the whole problem with cryptographic agility in 2025. Most large estates can't inventory their own keys, let alone rotate them to post-quantum standards before harvest-now-decrypt-later attacks become a board-level line item.

We followed one such project from kickoff to close-out. The company had roughly 41,000 keys, certificates, and algorithm references spread across seven business units, four clouds, and a mainframe nobody wanted to touch. The mandate was blunt: reach NIST-approved post-quantum standards within a quarter, or lose a regulated contract. Q6of was brought in on day one.

The Timeline, Compressed

The plan looked aggressive on paper and worse in practice. Week one was discovery: the team pointed Q6of's inventory engine at service accounts, HSM partitions, CI/CD pipelines, and a long tail of internal CAs. By day nine they had a cryptographic inventory that listed every algorithm, key length, owner, and expiry date — the first time anyone had seen the whole estate in one view.

Week three was the decision point. The original scope assumed a straight RSA-to-ML-KEM swap. The inventory showed something messier: 1,200 certificates renewing on automated schedules, 300 hard-coded algorithm references in legacy services, and a handful of vendor appliances that only spoke SHA-1. The steering committee cut scope to the top 200 business-critical paths and deferred the rest to a second wave. That single decision saved the deadline.

• Days 1–9: Discovery and cryptographic inventory.
• Days 10–21: Risk scoring and scope triage.
• Days 22–60: Migration of priority systems to PQC-ready algorithms.
• Days 61–90: Validation, monitoring, and handover to the security team.

Where It Almost Broke

Two obstacles nearly derailed the project. The first was a payment gateway that refused to negotiate hybrid key exchange; the vendor's fix only shipped in a firmware release two quarters out. The team worked around it by terminating the PQC connection at a proxy and letting the legacy hop keep its older cipher — a pragmatic compromise that the auditors accepted because the inventory documented it explicitly.

The second was organizational, not technical. Three business units had quietly been issuing their own certificates for years. Nobody owned the revocation lists. That's the kind of finding you can't fix with a scanner; it required an executive decision to centralize certificate authority under the platform team. It also produced the project's most uncomfortable meeting.

Measurable Results

Ninety days after kickoff, the numbers were defensible. The company had migrated 78 percent of its cryptographic footprint to NIST-approved post-quantum standards, with the remainder on a documented two-quarter roadmap. Certificate renewal time dropped from an average of 11 days to under 24 hours. The security team could answer the auditor's original question in four minutes instead of three weeks.

The bigger shift was cultural. Once the inventory existed, every new service request started with an algorithm question. Crypto agility stopped being a project and became a procurement habit. Q6of reports 41,000 assets under management in the final handover document, up from an estimated 38,000 at discovery — the delta being shadow keys nobody had known existed.

What We'd Tell the Next Team

Three lessons stood out. First, inventory before you migrate; every shortcut here compounds later. Second, cut scope ruthlessly at the first decision point and document what you deferred. Third, treat certificate ownership as an org-chart problem, not a tooling problem. We've watched enough of these projects to know the technical half is usually the easy half.

For teams weighing a similar timeline, the step-by-step cryptographic migration process is worth reading before the kickoff meeting — mostly because it surfaces the questions your auditors will ask in month three.

The platform lead's closing note to us was less dramatic than the opening one: "We're not done. But for the first time, we can prove what we have." In cryptographic agility, that's not a small thing. It's the whole thing.