PQC Migration Should Begin With Cryptographic Inventory, Not Algorithm Swaps

Experts warn that companies planning post-quantum cryptography (PQC) migration often make the mistake of jumping straight to replacing algorithms before understanding their existing cryptographic landscape. NIST has already standardized post-quantum algorithms including ML-KEM, ML-DSA, and SLH-DSA, but the real challenge lies in integrating these changes into live systems without breaking compatibility, performance, or inter-system trust. Classical public-key cryptography is embedded across a wide range of infrastructure — from TLS and VPNs to firmware signing and embedded devices — making a blind algorithm swap potentially ineffective or even risky. NIST's NCCoE now formally identifies cryptographic discovery and inventory as a foundational step in PQC migration, since organizations cannot prioritize what they haven't located. Tools like PQC Radar are being developed to guide this process systematically, helping teams map cryptographic assets with evidence and context before any migration decisions are made.