From Inventory to Action: A Risk-Based Scoring Model for Prioritizing PQC Migration at Enterprise Scale
· 10:45 – 11:10 Amsterdam time · Red hall
Many enterprises have now begun cryptographic discovery and built Cryptographic Bills of Materials (CBOMs), only to find themselves facing a new problem: a list of tens of thousands, sometimes millions, of cryptographic artifacts with no clear way to decide what to remediate first. Inventory answers "what do we have?" but it doesn't answer "where do we start?" This session presents a practical, risk-based scoring model for prioritizing post-quantum migration at enterprise scale, developed and applied in a large organizational environment. Rather than treating all inventoried artifacts as equally urgent, the model scores each one against a set of factors: exposure (internet-facing vs. internal-only), data sensitivity classification (e.g., PCI, PII, PHI), the harvest-now-decrypt-later (HNDL) risk window based on data longevity relative to projected quantum timelines, the availability of a non-invasive remediation path, business criticality, and environmental readiness (including whether the underlying platform even supports the protocols required for migration, since gaps here can mean a hardware refresh rather than a configuration change). Attendees will see how these factors combine into a composite priority score, walk through worked examples showing how superficially similar systems can land in very different priority tiers, and examine the model's limits, which will include a deliberate, defensible "cost exceeds risk, do not migrate yet" decision point and how to document that decision for auditors and leadership rather than treating it as an oversight. The session will also cover the organizational friction this approach surfaces in practice: who owns the scoring process, how it integrates with existing GRC and risk functions, and what changes as quantum timelines and remediation costs shift over time. Attendees will leave with an adaptable scoring rubric, a set of questions to apply to their own CBOM data, and a framework for prioritizing migration work that can be defended to stakeholders, not just executed against a spreadsheet.
Speakers
- Lead Security Solutions Advisor · Terra Quantum
Elizabeth Wood is a Lead Security Solutions Advisor at Terra Quantum, where she helps organizations prepare for the transition to post-quantum cryptography through cryptographic discovery, inventory, risk assessment, and migration strategy. She works with enterprises to develop practical approaches for cryptographic agility, quantum risk management, and large-scale PQC adoption.
Prior to joining Terra Quantum, Elizabeth was a founding member of the Quantum Security team within the Chief Security Office at AT&T, where she helped develop enterprise capabilities for all things quantum security including cryptographic inventory, quantum risk assessment, and post-quantum migration planning. Her background also includes software engineering and cloud modernization, giving her a practical perspective on implementing security initiatives within complex enterprise environments.
Elizabeth is an active contributor to the post-quantum cryptography community and frequently speaks and writes on topics including cryptographic discovery, Cryptographic Bills of Materials (CBOMs), quantum risk prioritization, and enterprise migration strategies. She is passionate about translating emerging quantum security challenges into actionable frameworks that organizations can implement today.
Attendance
Open session · first come, first served
Saving interest does not reserve a seat. Admission remains first come, first served.
Save favorite
