Solutions
Start from the obligation you actually have.
A federal contractor, a payments processor, a utility, and a team putting agents into production share the same underlying problem and none of the same constraints. The right first move depends on who is asking and what cannot break.
By situation
Different doors, same underlying problem.
Each path begins with the evidence your buyer, auditor, or regulator already expects.
Federal & defense
CNSA 2.0 readiness, cryptographic inventory, and contractor FAR compliance.
New NSS acquisitions are expected to be CNSA 2.0-compliant by default from January 1, 2027.
Financial services
HNDL exposure, long-lived records, and audit-ready cryptographic evidence.
Data that must stay confidential for 10–15 years can be considered exposed to harvest-now-decrypt-later collection today.
Software & supply chain
Code signing, CBOM delivery, and the questionnaires your buyers now send.
CNSA 2.0 requires ML-DSA or LMS/XMSS for software and firmware signing; larger RSA or ECDSA keys do not satisfy it.
Critical infrastructure & OT
Long asset life, constrained devices, and migrations that cannot take the plant down.
The executive order directs sector risk management agencies to help critical infrastructure owners develop PQC migration plans.
AI & agent security
Threat modeling, delegation, and Zero Trust for autonomous systems.
OWASP's Top 10 for Agentic Applications 2026 leads with goal hijack, tool misuse, and identity and privilege abuse.
Model one system first.
Run Threat Model Agent against one service group and review the output with your security architects before committing to a program.
4–6 weeks
Compare
The obligation, the constraint, the first move.
A short map of where each industry starts. Detail lives on the individual pages.
| Context | Primary obligation | Hardest constraint | Where we start |
|---|---|---|---|
| Federal & defense | CNSA 2.0 by default for new NSS acquisitions, Jan 1 2027 | Validation queue and fielded systems | Inventory against CNSA 2.0 |
| Financial services | Long-retention data and supervisory evidence | Payment rails and partner interoperability | HNDL exposure by data lifespan |
| Software & supply chain | Quantum-safe signing and CBOM delivery | Signatures already in the field | Signing pipeline migration |
| Critical infrastructure & OT | Long-horizon migration plans | Availability and 15–30 year asset life | Passive OT discovery |
| AI & agent security | Agent threat models and bounded authority | Prompt injection cannot be fully prevented | Model one agent and its tools |
Obligations are summarized for orientation only. Confirm applicability with your counsel and contracting officer.
Common ground
What every path shares.
Different industries, same three dependencies. If any of them is missing, the program stalls.
An inventory you trust
Including dependencies, firmware, and the cryptography your vendors shipped without telling you.
A definition of exposure
Data lifespan and business criticality, not a generic severity score, decide what gets fixed first.
The ability to change
Automated issuance, tested rollback, and policy gates. Without agility, the first migration is also the last.
Not listed?
The obligation matters more than the vertical.
If you are a healthcare provider, a manufacturer, or a SaaS company selling into regulated buyers, the same work applies. The readiness assessment maps the obligation to a first plan.