03 · Migration & cryptographic agility
Move without breaking production.
Execute the migration as a series of small, reversible changes: hybrid first, then pure PQC where standards and vendors allow. Every change is tested, recorded, and attributable.
The gap
The gap it closes.
Algorithm changes touch TLS termination, certificate chains, HSMs, firmware, and third-party dependencies at once. A big-bang cutover is how organizations turn a compliance deadline into an outage.
Hybrid key exchange
Roll out X25519 with ML-KEM-768 where interoperability requires it, with negotiated fallback and measured performance impact.
PQC certificate issuance
Issue ML-DSA and hybrid certificates from modern CAs, including staged trust-store distribution and chain validation testing.
Quantum-safe code signing
Migrate software and firmware signing to ML-DSA or the stateful hash-based schemes CNSA 2.0 requires — LMS and XMSS under SP 800-208.
HSM and KMS alignment
Track which modules support which algorithms, and sequence hardware refresh against the FIPS 140-3 validation queue instead of discovering the gap in production.
Capabilities
Built for the work.
The capability behind the outcome — not a feature list.
Hybrid key exchange
Roll out X25519 with ML-KEM-768 where interoperability requires it, with negotiated fallback and measured performance impact.
PQC certificate issuance
Issue ML-DSA and hybrid certificates from modern CAs, including staged trust-store distribution and chain validation testing.
Quantum-safe code signing
Migrate software and firmware signing to ML-DSA or the stateful hash-based schemes CNSA 2.0 requires — LMS and XMSS under SP 800-208.
HSM and KMS alignment
Track which modules support which algorithms, and sequence hardware refresh against the FIPS 140-3 validation queue instead of discovering the gap in production.
Staged rollout and rollback
Canary by service, measure handshake latency and failure rates, and keep a tested path back until the change is proven.
Dependency remediation
Produce upgrade guidance and open-source patches where you control the dependency, and vendor pressure where you do not.
Output
What you walk away with.
- Migrated TLS and certificate chains
- Quantum-safe signed software and firmware
- Change records and rollback runbooks
- Test evidence for each migrated service
Coverage
Where it fits.
- EJBCA, ADCS, and commercial CAs
- HSMs and cloud KMS services
- Load balancers, service mesh, and API gateways
- CI/CD signing pipelines
- Terraform and infrastructure policy engines
Services
When you want us to run it.
Platform output is only useful if it changes the system. These engagements do the work alongside your team.
Next step
Find out what you are actually running.
Cipher Posture finds and fixes quantum-vulnerable cryptography. Threat Model Agent models the whole system. Start with the readiness assessment.