Skip to main content
View as MarkdownOpen in ChatGPTOpen in Claude

Achieve post-quantum readiness

Post-quantum migration is a discovery-and-ownership problem before it is a cryptography problem. You can't migrate what you can't see, and you can't fix what no one owns. Axiad Mesh drives the whole cycle: ingest your cryptographic estate, correlate which cryptography lives in which software on which machines and who owns it, assess what's quantum-vulnerable against policy, notify the owner, and track the fix as your teams remediate it in your own systems.

The PQC dashboard is where this lives in the product; this page is the lifecycle behind it.

1. Ingest​

Mesh builds its picture of your cryptographic estate from two lanes:

  • Your inventory. Certificates, certificate templates, software assets, and machine assets are brought in through Mesh's offline import — you (or an upstream discovery tool) publish inventory files and Mesh collects them on a schedule. Certificate templates carry the algorithm and key-usage profile of your certificate authority, which matters for the next step.
  • Software cryptographic profiles. For the software your organization actually runs, Mesh produces a per-product cryptographic profile: the algorithms it uses, its certifications (such as FIPS 140-2/140-3 and Common Criteria), any deprecated primitives it still relies on, and a post-quantum readiness assessment framed against the NIST migration horizon. This turns a bare software list into a map of the cryptography inside it.

2. Correlate​

Discovery is only useful if the pieces connect. Mesh links your crypto estate together:

  • Certificate → its cryptography. A certificate inherits its algorithm and key-usage profile from the certificate template it was issued under — so importing your CA's templates makes each certificate's crypto attributes appear automatically, without hand-tagging.
  • Certificate → machine. Each certificate records the machine it's installed on.
  • Software → machine, and software → its cryptography. Software assets carry their own algorithm, deprecation, and certification data.

The result is the answer to the question migration actually turns on: which certificate, using which algorithm, lives in which software, on which machine. You explore these links in the Software / Certificate / Machine correlation tabs on an asset's detail view.

3. Assess​

Mesh evaluates every certificate, key, software, and machine asset against your cryptographic policies in real time. A policy marks each algorithm preferred, acceptable, deprecated, or prohibited, optionally with a migration deadline — so a post-quantum baseline can say classical public-key algorithms are acceptable today but prohibited after a target year, while post-quantum algorithms are already preferred.

Assets that use a deprecated or prohibited algorithm pick up a PQC noncompliant risk, and every crypto asset carries an owner — a missing one surfaces its own No owner risk, because an unowned certificate is one nobody will migrate. Grouped into a framework, these roll up to a post-quantum compliance percentage and the vulnerable-by-algorithm breakdown you see on the post-quantum Program.

A post-quantum readiness workspace in Axiad Mesh Generative UI showing discovery coverage, compliance status, NIST security-strength categories, algorithm lifecycle, and a crypto-agility heatmap

4. Notify​

A finding with an owner is a task; a finding without one is a dead end. Mesh routes crypto-agility work to the responsible owner through delegation: the assignee receives a direct notification with the scope of the work, your notes, and a link that takes them straight to the asset and its resolution steps — they don't need to know Mesh to act on it.

5. Remediate​

The actual rotation or reissuance happens in your certificate authority or certificate-lifecycle system — Mesh is the system of insight and coordination that tells you what to rotate, why, and who should do it, and then verifies it happened. Mesh discovers the vulnerable asset, prioritizes it by the loss exposure it carries, assigns it to the owner, and deep-links to the record in your CMDB — but it does not itself issue or rotate certificates.

Once your team rotates the certificate or migrates the software in its own system, Mesh reflects the fix the way it learns everything else — on the next collection cycle the asset is re-evaluated, the PQC-noncompliant risk clears, and your risk score and the post-quantum Program's progress recalculate. That closes the loop: discover → assign → migrate in your system → verified as resolved.

Why this matters​

Crypto agility isn't a one-time project — algorithms deprecate, standards move, and the post-quantum transition will unfold over years. Because Mesh continuously ingests, correlates, and re-assesses, your post-quantum readiness stays a live number rather than a point-in-time audit, and the moment a policy changes — a new prohibited algorithm, a nearer deadline — the assets that just fell out of compliance light up on their own.