If you want the simplest explanation for why post-quantum migration is sputtering, it’s this: most organizations can’t change their cryptography without breaking something they care about—availability, compatibility, or compliance. That’s a crypto-agility problem, and it’s showing up everywhere from federal agencies to Fortune 500 back-ends.

What we’ve seen so far the month;

• U.S. federal reality check. A new Government Accountability Office review says the federal plan still lacks interim milestones, clear performance measures, and a single coordinating owner for the national PQC strategy—while OMB pegs the migration cost at ~$7.1B (2025–2035) for priority civilian systems and admits the estimate is rough. Translation: agencies are inventorying crypto, but moving production systems remains hard without agility baked in.  
• Enterprise readiness is thin. A fresh academic study finds fewer than 5% of enterprises have a formal quantum-transition plan; vendor surveys echo the gap, with nearly half of orgs saying they’re not prepared for PQC. That’s not a skills issue alone—it’s architecture and process: brittle PKI, opaque certificates, hard-coded crypto, and no way to swap algorithms at speed.  
• Standards are not the blocker. NIST has finalized the first three PQC standards—ML-KEM (FIPS 203), ML-DSA (FIPS 204), and SLH-DSA (FIPS 205)—and maintains up-to-date migration resources; the EU published its own PQC roadmap in June. The road signs are there; lanes are missing inside organizations.  

What “crypto-agility” actually means

It’s the ability to discover, change, and validate cryptography (algorithms, key sizes, protocols, trust anchors) without rewriting your business logic or taking downtime. Practically, that looks like:

• Discoverability: continuous inventories of keys, certs, ciphers, libraries, and protocol endpoints (TLS, SSH, IPsec, S/MIME, code-signing, device firmware).
• Swapability: abstraction layers and policy-driven config so you can introduce PQC or hybrid modes (e.g., ML-KEM + X25519) without forking apps.
• Verifiability: automated tests, monitoring, and attestation to prove which crypto is actually in use (and where).

Without these, “migrate to PQC” devolves into system-by-system heroics.

The risk isn’t hypothetical

“Harvest now, decrypt later” turns today’s sensitive traffic (auth, payments, health, IP) into tomorrow’s cleartext once cryptanalytically relevant quantum computers arrive. NIST, NSA/CNSA, and EU guidance all say: begin migration now, starting with long-lived data and high-value systems. Waiting for a calendar date is not a strategy; building agility is. 

A recommended 90-day plan

Weeks 1–3 — Make the unknowns known

• Run a cryptography discovery at scale. Inventory protocols, cipher suites, libraries (OpenSSL/BoringSSL/OS crypto APIs), HSMs, and code-signing pipelines. Tag business services and data classes to each endpoint. (NIST NCCoE’s discovery guidance is a good backbone.)  
• Publish a living CBOM (Cryptographic Bill of Materials). Include ownership, change windows, vendor dependencies, cert expiration, and “can be hybridized?” flags.

Weeks 4–6 — Prove you can swap

• Stand up a PQC/hybrid reference stack in a sandbox: TLS with ML-KEM key establishment (hybrid with X25519), and ML-DSA for service and code-signing. Measure handshake sizes, CPU, and latency. Document client/server breakage points and MTUs. (NIST FIPS give the parameters; your job is wiring and SLOs.) 
• Abstract crypto config. Move algorithms and policy to config/feature flags (not source). For commercial platforms (load balancers, API gateways, MDM, EDR, mail), get vendor roadmaps in writing and test betas.

Weeks 7–9 — Cut the riskiest blast radius

• Prioritize long-lived secrets and archives. Turn on hybrid key establishment where supported; stop creating new long-lived RSA/ECC debt for backups, archives, device boot chains, and inter-service messaging.
• Lock in certificate & key lifecycles. Shorten lifetimes, enable automated renewal, and prepare dual-stack trust chains (classical + PQC).

Weeks 10–12 — Make it sustainable

• Create an enterprise crypto steering function. Security + platform + networking + compliance. Mandate crypto reviews for major launches and vendor buys.
• Define “done” in metrics: % endpoints discovered; % business-critical flows with hybrid KEM; % signing workflows PQC-capable; # vendors contractually committed to PQC timelines.

What to tell the management board

• This is not a moonshot. Standards exist and are being updated (NIST FIPS 203/204/205; EU roadmap). The work is execution: taming complexity in your own stack.  
• Delay compounds risk and cost. GAO highlights missing milestones and coordination—don’t replicate that internally. Set interim goals and owners now.  
• Agility pays beyond PQC. The same controls help rotate away from broken ciphers, respond to library 0-days, and meet emerging procurement rules.

The Quantum Space Comment

The PQC story is no longer about algorithms—it’s about operations. Organizations that treat crypto like a product (with assets, owners, SLAs, and roadmaps) will absorb PQC with far less pain. Those that don’t will discover, the hard way, that lack of crypto-agility is a security issue and a business-continuity issue.

Sources

• GAO (Jun 24, 2025): Leadership Needed to Coordinate Cyber Threat Mitigation Strategy — notes OMB’s ~$7.1B estimate and gaps in milestones/roles.  
• NIST (Aug 13, 2024; updated Aug 29, 2025): NIST releases first 3 finalized PQC standards (FIPS 203/204/205).  
• FIPS 203 (ML-KEM): Final standard page.  
• NIST NCCoE FAQ (Sep 3, 2025): Migration resources, timelines, and international guidance (incl. ETSI/EU).  
• Enterprise readiness (Sep 2025): Are Enterprises Ready for Quantum-Safe Cybersecurity? (arXiv preprint; <5% with formal transition plans).  
• Survey context (Aug 2025): Keyfactor study coverage — ~48% unprepared.