Cryptographic modernisation treats cryptography as a managed asset class with an owner, a budget and a lifecycle. The evidence from Equifax, Starlink, the Entrust distrust, Heartbleed and Marriott shows what unmanaged cryptography already costs, why cyber insurance may not cover it, and why post-quantum migration is one more forced change on the same list.