Post-Quantum Cryptography Inventory: What Security Teams Need to Find First

Inventory is the first migration control

Post-quantum migration starts with a simple question that most organizations still cannot answer: where is classical cryptography used? A useful inventory must cover more than certificates. It needs source-code evidence, dependency evidence, protocol posture, infrastructure configuration, and the places where applications handle sensitive data.

What to include

A practical inventory should track cryptographic usage in the developer workflow and the runtime perimeter so remediation can be owned by the teams that ship software.

• RSA, ECC, DH, ECDH, ECDSA, EdDSA, and other Shor-vulnerable public-key usage
• TLS endpoints, certificates, SSH key exchange, JWT/JWS, SAML metadata, and mTLS trust roots
• Dependencies, package manifests, infrastructure configuration, and embedded keys
• Evidence exports such as JSON, SARIF, Markdown, HTML, and release-gate signals

Where RelixQ fits

RelixQ starts from a complete cryptography inventory and extends it into QAST: HNDL exposure windows, attack paths, safe validation, RelixQ Score impact, retests, reports, and PR gates.