210 Security — Field notesPractical writing on post-quantum migration, cryptographic inventories, signing, and identity for AI agents.https://210security.com/en-usWhat changed in threat modeling in 2026https://210security.com/blog/what-changed-in-threat-modeling-2026/https://210security.com/blog/what-changed-in-threat-modeling-2026/Continuous models, agentic threats, a consolidated tooling market, and a legal obligation. What actually changed this year, with sources.Wed, 28 Oct 2026 14:00:00 GMTthreat-modelingcomplianceA reference pipeline for post-quantum code signinghttps://210security.com/blog/signing-migration-reference-pipeline/https://210security.com/blog/signing-migration-reference-pipeline/Eight stages, mandatory dual signing, stateful key custody, and an illustrative signing-step config for moving code signing to post-quantum algorithms.Fri, 23 Oct 2026 13:00:00 GMTcode-signingpqcWhat CNSA 2.0 doesn't approve — and why it mattershttps://210security.com/blog/what-cnsa-2-0-does-not-approve/https://210security.com/blog/what-cnsa-2-0-does-not-approve/CNSA 2.0 approves ML-KEM-1024 and ML-DSA-87 and requires LMS or XMSS for signing. It does not approve SLH-DSA for national security systems. Here is what that changes.Fri, 23 Oct 2026 11:00:00 GMTcnsacode-signingA worked CBOM example: owners, lifespan, and riskhttps://210security.com/blog/a-worked-cbom-example/https://210security.com/blog/a-worked-cbom-example/An illustrative CBOM for a fictional payments platform: eight assets, the two fields that make it prioritizable, and the migration order they imply.Fri, 23 Oct 2026 09:00:00 GMTcbominventoryHybrid vs. pure PQC: how to sequence a safe cutoverhttps://210security.com/blog/hybrid-vs-pure-pqc/https://210security.com/blog/hybrid-vs-pure-pqc/Hybrid key exchange as a transition mechanism, where pure PQC is expected, what it costs on the wire, and a four-stage sequencing model.Fri, 23 Oct 2026 00:00:00 GMTpqctlsAI agents are the new certificate problemhttps://210security.com/blog/ai-agents-are-the-new-certificate-problem/https://210security.com/blog/ai-agents-are-the-new-certificate-problem/Agents inherit long-lived keys because systems accept them. Workload identity, token exchange, and an inventory-first path out of the mess.Tue, 20 Oct 2026 00:00:00 GMTidentityagentsCode signing is your first post-quantum deadlinehttps://210security.com/blog/code-signing-first-deadline/https://210security.com/blog/code-signing-first-deadline/Firmware and software signatures outlive the algorithms protecting them. What CNSA 2.0 requires, and how to sequence a signing migration.Tue, 13 Oct 2026 00:00:00 GMTcode-signingfirmwareHarvest now, decrypt later: the board-level casehttps://210security.com/blog/harvest-now-decrypt-later/https://210security.com/blog/harvest-now-decrypt-later/Why the useful question is confidentiality lifetime, not quantum timelines, with a scoring model and a hypothetical worked example.Tue, 06 Oct 2026 00:00:00 GMTriskstrategyWhat a cryptographic bill of materials actually containshttps://210security.com/blog/what-a-cbom-contains/https://210security.com/blog/what-a-cbom-contains/CBOM versus SBOM, the seven field groups that make a CBOM useful, a labeled JSON excerpt, and five mistakes that turn it into shelfware.Tue, 22 Sep 2026 00:00:00 GMTcbominventoryThe 2030 clock: every post-quantum deadline that mattershttps://210security.com/blog/the-2030-clock/https://210security.com/blog/the-2030-clock/The dated obligations from the 2026 FIPS 140-2 sunset to NIST's proposed 2035 disallowance, and why inventory comes before algorithms.Tue, 08 Sep 2026 00:00:00 GMTcomplianceplanning