Blog
Field notes from the cryptography transition.
What we are seeing in real migration programs, written down properly. No newsletter gate, no listicle framing, and a source for anything that sounds like a claim.
Featured
October 28, 2026
What changed in threat modeling in 2026
Continuous models, agentic threats, a consolidated tooling market, and a legal obligation. What actually changed this year, with sources.
Read
Featured
September 8, 2026
The 2030 clock: every post-quantum deadline that matters
The dated obligations from the 2026 FIPS 140-2 sunset to NIST's proposed 2035 disallowance, and why inventory comes before algorithms.
ReadAll writing
- October 23, 2026 A reference pipeline for post-quantum code signing Eight stages, mandatory dual signing, stateful key custody, and an illustrative signing-step config for moving code signing to post-quantum algorithms.
- October 23, 2026 What CNSA 2.0 doesn't approve — and why it matters CNSA 2.0 approves ML-KEM-1024 and ML-DSA-87 and requires LMS or XMSS for signing. It does not approve SLH-DSA for national security systems. Here is what that changes.
- October 23, 2026 A worked CBOM example: owners, lifespan, and risk An illustrative CBOM for a fictional payments platform: eight assets, the two fields that make it prioritizable, and the migration order they imply.
- October 23, 2026 Hybrid vs. pure PQC: how to sequence a safe cutover Hybrid key exchange as a transition mechanism, where pure PQC is expected, what it costs on the wire, and a four-stage sequencing model.
- October 20, 2026 AI agents are the new certificate problem Agents inherit long-lived keys because systems accept them. Workload identity, token exchange, and an inventory-first path out of the mess.
- October 13, 2026 Code signing is your first post-quantum deadline Firmware and software signatures outlive the algorithms protecting them. What CNSA 2.0 requires, and how to sequence a signing migration.
- October 6, 2026 Harvest now, decrypt later: the board-level case Why the useful question is confidentiality lifetime, not quantum timelines, with a scoring model and a hypothetical worked example.
- September 22, 2026 What a cryptographic bill of materials actually contains CBOM versus SBOM, the seven field groups that make a CBOM useful, a labeled JSON excerpt, and five mistakes that turn it into shelfware.
Start here
See where your program stands.
The ten-minute readiness assessment turns the questions in these posts into a score, your weakest domains, and a first-90-days plan.