Post-Quantum Cryptography Inventory: What Security Teams Need to Find First

Inventory is the first migration control

Post-quantum migration starts with a simple question that most organizations still cannot answer: where is classical cryptography used? A useful inventory must cover more than certificates. It needs source-code evidence, dependency evidence, protocol posture, infrastructure configuration, and the places where applications handle sensitive data.

What to include

A practical inventory should track cryptographic usage in the developer workflow and the runtime perimeter so remediation can be owned by the teams that ship software.

• RSA, ECC, DH, ECDH, ECDSA, EdDSA, and other Shor-vulnerable public-key usage
• TLS endpoints, certificates, SSH key exchange, JWT/JWS, SAML metadata, and mTLS trust roots
• Dependencies, package manifests, infrastructure configuration, and embedded keys
• Evidence exports such as JSON, SARIF, Markdown, HTML, and release-gate signals

Where RelixQ fits

RelixQ OSS focuses on transparent local discovery. RelixQ Enterprise extends that inventory into QAST by adding HNDL exposure windows, attack paths, safe validation, RelixQ Score impact, retests, reports, and PR gates.