Post-quantum readiness is an inventory problem

Discussion of post-quantum cryptography tends to begin with algorithms. For a bank or insurer, the binding constraint is earlier: an accurate account of certificates, keys and the machine identities that hold them.

The algorithm question is real, and it is also the most delegated part of the problem. Standards bodies publish the schemes; vendors and platforms will implement them. An institution's choice of algorithm will, in practice, be made for it by its suppliers and its regulators. What neither can supply is a map of what the institution actually runs.

That map is the inventory: every certificate and key, where it lives, what issued it, what depends on it and who answers for it. Certificates sit in load balancers, applications, vendor appliances, signing systems and partner integrations. Each has an issuer, an expiry and an owner — in theory. In practice, the estate is partial, and everyone who has looked closely knows it.

Cryptographic inventory and non-human identity inventory are largely the same exercise conducted by different teams. The certificate on a service is held by a machine identity. The key in an integration is held by a machine identity. The team that tracks certificates and the team that governs service accounts are counting the same population from different ends, and the two counts rarely meet.

This is why the sequencing argument matters. Migration planning against an incomplete inventory produces a plan that looks complete and is not. The gap is discovered by the first migration wave, in production, on a deadline — the worst possible conditions for discovering that a forgotten integration still depends on a certificate nobody owned.

Readiness, properly understood, is a sequence. First, an inventory that names every certificate and key, its owner, its purpose and its dependencies. Second, a view of which credentials are long-lived and hard to rotate, because those set the real timeline. Third, a migration order derived from that inventory — not from a vendor roadmap or a conference agenda.

The phrase cryptographic agility is often used to describe a purchasing property. It is better understood as an inventory property. An institution can change algorithms quickly only where it knows what it has. Agility is the dividend paid by the count, not a feature of the new schemes.

There is a governance point here that outlives the current migration. The institutions that struggled to answer basic questions about their keys are the same institutions that cannot say how many service accounts they run or who owns them. The post-quantum programme is simply the first deadline that makes the gap expensive. It will not be the last.

X2A treats readiness as a governance question rather than a product decision. It is a perspective, not a service line.

The timeline pressure is real, and the standards work is welcome. But the first milestone of a credible programme is not an algorithm. It is a count you trust — of keys, of certificates, of the machine identities that hold them. Institutions that start there will find the rest of the migration is engineering. Institutions that do not will find it is archaeology.