Discovery Tells the Truth: What Real Crypto Inventories Reveal About PQC Readiness

The post-quantum transition is widely called "complex," but that word hides what the complexity actually is. PQC migration is both a technical challenge and an organizational one, and it is only when organizations begin cryptographic discovery that the full scope of both becomes visible. Discovery consistently reveals more than teams expect, and what it reveals is far more useful. Grounded in real data from discovery work across many organizations, including large-scale automated discovery, this session shows what discovery actually uncovers: not just the sprawl of keys, certificates, and protocols in use, but the organizational maturity behind them. Consider a pattern we see repeatedly: organizations that worked hard to eliminate SHA-1 from their certificates, while quietly continuing to rely on SHA-1 in SSH. The same weak algorithm, retired where governance was watching and untouched where it was not.

Discovery turns out to be a remarkably honest signal. The state of an organization's crypto policy, the clarity of its roles and responsibilities, and the strength of its day-to-day cryptography management tend to move together, and discovery exposes all of it at once. Attendees will leave able to read their own discovery results not just as a technical inventory, but as an honest measure of how ready they really are. Because cryptographic maturity isn't what you fixed where everyone was looking. It's what you did where no one was.