The Challenge
When Marin Ivezic, CEO of Applied Quantum, began planning post-quantum cryptography (PQC) migration programs for enterprise clients, he anticipated a technical challenge. Instead, he encountered an organizational transformation involving over 120,000 tasks. Here's the concerning part: only 30,000 of those tasks directly involved cryptography.
The rest? Inventory management, vendor negotiations, regulatory mapping, team training, process redesign, and governance changes. These are the tasks that don't appear in your cryptography vendor's guide but will determine whether your migration succeeds or stalls in year two.
"It's not the number itself that is important," Ivezic noted. "It shows the size and complexity of these programs, which most people don't grasp until they're stuck in one."
The Environment and Constraints
Most enterprises aren't moving on PQC migration yet. Gregory Skulmoski, professor at Bond University, highlighted competing priorities: "They are busy implementing AI and its governance, or other cybersecurity projects like hardening with zero trust. It's hard to lift your head and start thinking about quantum."
This isn't procrastination. It's rational resource allocation under constraint. Your CISO has three open headcount requests, two audit findings to close, and a board that wants quarterly AI risk updates. Quantum-safe cryptography feels theoretical until NIST finalizes standards and your auditors start asking questions.
But that delay creates a planning gap. Organizations that wait until quantum risk becomes urgent will face the 120,000-task reality without the lead time to staff it properly or integrate it into existing programs.
The Approach Taken
Ivezic's programs broke PQC migration into categories that extended far beyond algorithm replacement:
Cryptographic discovery and inventory. You can't migrate what you don't know exists. This means scanning applications, databases, APIs, hardware security modules, certificate stores, and third-party integrations. It also means documenting which systems use which algorithms, who owns them, and what dependencies exist.
Discovery doesn't finish. New code ships. Vendors update libraries. Acquisitions bring in shadow IT. A defensible starting point means accepting that your inventory will never be 100% complete and building continuous discovery into your security operations.
Vendor and procurement integration. Every SaaS contract, cloud service agreement, and hardware purchase becomes a PQC decision point. Can your identity provider migrate to quantum-resistant algorithms? Will your payment processor support PQC key exchange? Does your HSM vendor have a roadmap?
Muria Roberts, director at QTM-X Quantum Advisory Indonesia, emphasized treating this as organizational hygiene: "We have to treat it as a cyber hygiene, business resilience and trust infrastructure issue." That means embedding PQC readiness questions into your vendor risk assessments and procurement workflows now, before you're negotiating renewals under time pressure.
Governance and accountability. Who owns PQC migration? If the answer is "the cryptography team," you've already scoped it wrong. Ivezic's task breakdown shows why: the majority of work sits outside cryptography. You need executive sponsorship, cross-functional working groups, and a program management office that can coordinate infrastructure, application, vendor, and compliance workstreams.
The governance gap is the biggest blocker. Without clear ownership and decision rights, PQC migration becomes a technical project that stalls every time it hits a procurement question, a vendor negotiation, or a budget allocation.
Team upskilling and literacy. Your developers need to understand which libraries are quantum-safe. Your procurement team needs to evaluate vendor PQC roadmaps. Your risk committee needs to understand why you're prioritizing certain systems over others. That's a literacy challenge, not just a training one.
Results and Metrics
The 120,000-task programs Ivezic led demonstrate scale, but the more important metric is the ratio: three-quarters of the work fell outside traditional cryptography tasks. That distribution holds implications for how you budget, staff, and timeline your own migration.
If you're planning a PQC program and your project plan focuses primarily on algorithm replacement, you're underestimating scope by a factor of four. The work that takes longest isn't the cryptography. It's the vendor negotiations that drag into quarter two. The compliance mapping that uncovers gaps in your third-party risk program. The governance discussions about whether to prioritize customer-facing systems or internal controls first.
What They Would Do Differently
The panel identified three areas where early investment pays off:
Start vendor conversations now. Don't wait until you're ready to migrate. Ask your critical vendors about their PQC roadmaps today. Document their answers. Flag the ones who don't have a plan. That information becomes leverage in your next renewal negotiation and helps you identify which vendor relationships need replacement, not just migration.
Build cryptographic agility into new systems. Every new application you deploy, every API you build, every integration you architect is either quantum-safe by design or technical debt you'll pay down later. Cryptographic agility, the ability to swap algorithms without rewriting core logic, should be a non-negotiable requirement in your secure development standards.
Treat governance as the first workstream, not the last. You can't run a 120,000-task program without executive sponsorship, clear ownership, and decision-making authority. Establishing governance early means you can move when you hit budget questions, vendor impasses, or competing priorities. Waiting until you're stuck means every decision escalates.
Takeaways for Your Team
Post-quantum cryptography migration isn't a technical upgrade. It's an organizational transformation that touches every part of your enterprise that relies on cryptography for confidentiality, integrity, or authentication. Which is to say: all of it.
Start with discovery, but don't wait for perfect inventory. Build PQC readiness into your vendor management process now, before your next renewal cycle. Establish governance and executive sponsorship early, because the work that takes longest isn't the cryptography, it's the cross-functional coordination.
And when you're scoping the program, remember Ivezic's ratio: if 25% of your tasks touch cryptography directly, you've probably captured the technical work. The other 75% is organizational change management, and that's where most programs stall.
