# Achieve post-quantum readiness

Post-quantum migration is a discovery-and-ownership problem before it is a
cryptography problem. You can't migrate what you can't see, and you can't fix
what no one owns. Axiad Mesh drives the whole cycle: **ingest** your
cryptographic estate, **correlate** which cryptography lives in which software on
which machines and who owns it, **assess** what's quantum-vulnerable against
policy, **notify** the owner, and track the fix as your teams **remediate** it in
your own systems.

The [PQC dashboard](../user-guide/pqc-dashboard.md) is where this lives in the
product; this page is the lifecycle behind it.

## 1. Ingest

Mesh builds its picture of your cryptographic estate from two lanes:

- **Your inventory.** Certificates, **certificate templates**, software assets,
  and machine assets are brought in through Mesh's offline import — you (or an
  upstream discovery tool) publish inventory files and Mesh collects them on a
  schedule. Certificate templates carry the algorithm and key-usage profile of
  your certificate authority, which matters for the next step.
- **Software cryptographic profiles.** For the software your organization
  actually runs, Mesh produces a per-product cryptographic profile: the
  algorithms it uses, its certifications (such as FIPS 140-2/140-3 and Common
  Criteria), any deprecated primitives it still relies on, and a post-quantum
  readiness assessment framed against the NIST migration horizon. This turns a
  bare software list into a map of the cryptography inside it.

## 2. Correlate

Discovery is only useful if the pieces connect. Mesh links your crypto estate
together:

- **Certificate → its cryptography.** A certificate inherits its algorithm and
  key-usage profile from the **certificate template** it was issued under — so
  importing your CA's templates makes each certificate's crypto attributes appear
  automatically, without hand-tagging.
- **Certificate → machine.** Each certificate records the machine it's installed
  on.
- **Software → machine, and software → its cryptography.** Software assets carry
  their own algorithm, deprecation, and certification data.

The result is the answer to the question migration actually turns on: *which
certificate, using which algorithm, lives in which software, on which machine.*
You explore these links in the **Software / Certificate / Machine** correlation
tabs on an asset's detail view.

## 3. Assess

Mesh evaluates every certificate, key, software, and machine asset against your
[cryptographic policies](../concepts/policies.md) in real time. A policy marks
each algorithm **preferred**, **acceptable**, **deprecated**, or **prohibited**,
optionally with a migration deadline — so a post-quantum baseline can say
classical public-key algorithms are acceptable today but prohibited after a
target year, while post-quantum algorithms are already preferred.

Assets that use a deprecated or prohibited algorithm pick up a **PQC noncompliant**
risk, and every crypto asset carries an owner — a missing one surfaces its own
**No owner** risk, because an unowned certificate is one nobody will migrate.
Grouped into a framework, these roll up to a post-quantum compliance percentage
and the vulnerable-by-algorithm breakdown you see on the
[post-quantum Program](../concepts/programs.md).

![A post-quantum readiness workspace in Axiad Mesh Generative UI showing discovery coverage, compliance status, NIST security-strength categories, algorithm lifecycle, and a crypto-agility heatmap](/img/generative-ui/operator-workspace.png)

## 4. Notify

A finding with an owner is a task; a finding without one is a dead end. Mesh
routes crypto-agility work to the responsible owner through
[delegation](../concepts/delegation.md): the assignee receives a direct
notification with the scope of the work, your notes, and a link that takes them
straight to the asset and its resolution steps — they don't need to know Mesh to
act on it.

## 5. Remediate

The actual rotation or reissuance happens in **your** certificate authority or
certificate-lifecycle system — Mesh is the system of insight and coordination
that tells you *what* to rotate, *why*, and *who* should do it, and then verifies
it happened. Mesh discovers the vulnerable asset, prioritizes it by the
[loss exposure](../concepts/risk-scoring.md#from-scores-to-loss-estimates) it
carries, assigns it to the owner, and deep-links to the record in your CMDB — but
it does not itself issue or rotate certificates.

Once your team rotates the certificate or migrates the software in its own
system, Mesh reflects the fix the way it learns everything else — on the next
collection cycle the asset is re-evaluated, the PQC-noncompliant risk clears, and
your [risk score](../concepts/risk-scoring.md) and the post-quantum Program's
progress recalculate. That closes the loop: discover → assign → migrate in your
system → verified as resolved.

## Why this matters

Crypto agility isn't a one-time project — algorithms deprecate, standards move,
and the post-quantum transition will unfold over years. Because Mesh continuously
ingests, correlates, and re-assesses, your post-quantum readiness stays a live
number rather than a point-in-time audit, and the moment a policy changes — a new
prohibited algorithm, a nearer deadline — the assets that just fell out of
compliance light up on their own.

## Related

- [PQC dashboard](../user-guide/pqc-dashboard.md) — the product surface for
  crypto assets.
- [Policies](../concepts/policies.md) — the algorithm rules behind the
  assessment.
- [Programs](../concepts/programs.md) — tracking the migration as an initiative.
- [Remediation](../concepts/remediation.md) and
  [Delegation](../concepts/delegation.md) — assigning and resolving the work.