Testing Your Systems for Quantum Readiness

You cannot protect what you have not measured. Testing your systems for quantum readiness turns an abstract threat into a concrete, actionable assessment. Here is how to evaluate where you stand.

Step 1 — Cryptographic Discovery

Map every cryptographic dependency in your estate:

• Network: TLS endpoints, VPNs, SSH, IPsec, load balancers, CDNs.
• Applications: libraries, hardcoded algorithms, API authentication, JWT signing.
• Storage: disk encryption, database encryption, backups, archives.
• Signing: code signing, firmware signing, document signing, certificates.
• Identity: PKI, smart cards, HSMs, key vaults.
• Third parties: SaaS, cloud KMS, APIs, SDKs.

Use automated scanners that inspect binaries, configs, certificates and network traffic. Manual review fills the gaps.

Step 2 — Data Lifetime Mapping

For each cryptographic asset, identify the data it protects and how long that data must stay confidential:

• < 2 years: low priority (re-encrypt later).
• 2-10 years: medium priority.
• 10+ years: high priority — exposed to harvest-now-decrypt-later.

This mapping drives your entire prioritisation.

Step 3 — Algorithm Risk Scoring

Score each algorithm:

• RSA, ECC, DH: high quantum risk — must migrate.
• AES-128: medium (quantum reduces to ~64-bit) — upgrade to AES-256.
• AES-256: quantum-resistant — keep.
• SHA-256, SHA-3: quantum-resistant — keep.
• MD5, SHA-1, DES, 3DES, RC4: broken — eliminate regardless of quantum.

Step 4 — Crypto-Agility Assessment

For each system, ask:

• Can the algorithm be changed without rewriting code?
• Are key sizes hardcoded?
• Can new algorithms be added to protocols?
• Is there a rollback path?

Low agility = high migration cost = high risk.

Step 5 — Exposure Assessment

• Is the encrypted data transmitted over networks adversaries can intercept?
• Are keys stored in HSMs or in software?
• Are there long-lived keys that, if broken, compromise large amounts of data?
• Are there third-party dependencies whose quantum-readiness you cannot verify?

Step 6 — Supplier and Supply-Chain Review

• Query vendors for quantum-readiness roadmaps.
• Identify single points of cryptographic failure in the supply chain.
• Assess open-source dependencies for post-quantum support.

Step 7 — Quantify the Risk

Combine the above into a risk score per system:

Risk = Data sensitivity × Data lifetime × Algorithm quantum risk × Exposure × (1 / Crypto-agility)

Rank systems and produce a prioritised migration backlog.

Step 8 — Produce the Report

Document:

• The cryptographic inventory.
• The data lifetime map.
• The risk scores and priorities.
• The gaps in crypto-agility.
• The recommended migration phases.
• The budget and timeline estimates.

This report is what you take to leadership to justify the programme.

Tools That Help

• Crypto-discovery scanners (commercial and open source).
• TLS scanners that report key exchange groups.
• Certificate transparency logs for certificate inventory.
• SBOM (software bill of materials) tools for dependency crypto.
• Post-quantum test libraries to pilot algorithms.

Bottom Line

Testing for quantum readiness is a structured assessment: discover, map lifetimes, score algorithms, assess agility, quantify exposure, prioritise. The output is a concrete migration backlog and a board-ready risk picture. Done well, it turns a vague future threat into a managed programme — and tells you exactly where to start.