Q-Day is not a breach you can patch. It is a condition you prepared for or did not. What unfolds, who is exposed and why incident response does not apply.

PQC discovery is the entry requirement for any post-quantum cryptography (PQC) programme. An organisation that cannot show which cryptography it runs, where it runs and who owns it has no basis for prioritising, sequencing or reporting a migration. A Cryptographic Bill of Materials (CBOM) is often offered as proof that this work has been done. It is a different thing. This article sets out the distinction, the governance consequences of confusing the two and three questions a

The Missing Discipline The post-quantum conversation has a numbers problem. Vendors love to say they have found millions of cryptographic assets. That sounds serious. It sounds comprehensive. It sounds like the sort of number a board should pay attention to. But in most environments, that number is doing a lot of rhetorical work. What organisations usually have are millions of cryptographic instances. The same library. The same certificate. The same key store. The same implem

𝐏𝐐𝐂 𝐝𝐢𝐬𝐜𝐨𝐯𝐞𝐫𝐲 𝐚𝐧𝐝 𝐫𝐞𝐦𝐞𝐝𝐢𝐚𝐭𝐢𝐨𝐧 𝐯𝐞𝐧𝐝𝐨𝐫𝐬 𝐥𝐨𝐯𝐞 𝐭𝐞𝐥𝐥𝐢𝐧𝐠 𝐨𝐫𝐠𝐚𝐧𝐢𝐬𝐚𝐭𝐢𝐨𝐧𝐬 𝐭𝐡𝐞𝐲 𝐡𝐚𝐯𝐞 "𝐦𝐢𝐥𝐥𝐢𝐨𝐧𝐬 𝐨𝐟 𝐜𝐫𝐲𝐩𝐭𝐨𝐠𝐫𝐚𝐩𝐡𝐢𝐜 𝐚𝐬𝐬𝐞𝐭𝐬." That sounds impressive. In reality, it frequently conflates cryptographic #instances with unique cryptographic #dependencies. There is a fundamental difference. The same cryptographic library, certificate, key store, or implementation can appear thousands of times across ser

From "Dark Matter" Liability to Defensible Fiduciary Asset 1. Executive Summary: The Fiduciary Imperative In a $100T digital economy, cryptography is the invisible keel holding the ship of state and commerce upright. It secures identity, privacy, and value transfer. Yet 95% of enterprises operate with near-zero visibility into where this cryptography lives, how it behaves, or whether it remains fit for purpose (NIST). This hidden exposure has evolved into Cryptographic Dark M

Why organisations are suddenly asking about #QBOM and what it may actually mean Over the past 48 hours we have seen a surge of calls from Indian organisations and global vendors operating in India. The question has been: “What is a QBOM, and do we need to produce one?” The confusion comes from India’s National Quantum Mission report. It references QBOM in the glossary, but does not define it, scope it, mandate it, attach a schema, or link it to procurement or certification. S