From PKI to PQC: The crypto transformation roadmap for enterprises

Practical enterprise roadmap for transitioning traditional PKI to quantum-safe, crypto-agile trust services

November 2, 2026

Vinod Baburao Wagh

Deputy General Manager, Cybersecurity, HCLTech

November 2, 2026

Executive summary

Quantum computing will not simply introduce a new algorithm choice; it will force enterprises to re-engineer how cryptography is discovered, governed, migrated and continuously monitored. Traditional PKI remains the foundation of digital trust, but it must evolve into PQC-enabled, crypto-agile infrastructure. Organizations should begin with visibility, build a Cryptographic Bill of Materials (CBOM), prioritize high-risk use cases and then execute controlled hybrid and PQC migration waves across certificates, TLS, signing, key management and dependent applications.

The coming cryptographic disruption

For decades, Public Key Infrastructure (PKI) has provided the trust fabric for enterprise security: TLS communications, digital certificates, identity platforms, application authentication, code signing and secure business transactions. That trust fabric is now entering a major transition. Large-scale quantum computers, when available, may weaken widely used public-key algorithms such as RSA and elliptic-curve cryptography (ECC). As a result, enterprises must prepare before the risk becomes operationally urgent.

The shift from PKI to Post-Quantum Cryptography (PQC) is not a single technology upgrade. It is a strategic crypto transformation program that touches architecture, compliance, vendors, lifecycle operations, asset inventories and business-critical applications.

Why enterprises must act now

Harvest now, decrypt later risk: Sensitive encrypted data can be captured today and retained for future decryption. Long-lived data such as financial records, intellectual property, regulated data and confidential business information require early protection planning.

Cryptography is everywhere: Crypto is embedded across applications, devices, cloud platforms, APIs, databases, networks, IoT, firmware and third-party products. Without discovery, enterprises cannot determine migration scope.

Standards are now available: NIST finalized its first three PQC standards in 2024: ML-KEM for key establishment, ML-DSA for digital signatures and SLH-DSA for stateless hash-based signatures.

Migration will take years: Enterprise crypto modernization requires sequencing, compatibility testing, vendor readiness checks, policy updates and phased cutovers. Starting early reduces business disruption.

PKI today vs. PQC-enabled PKI tomorrow

The six-phase crypto transformation roadmap

Priority enterprise use cases

• TLS and external-facing services: Hybrid key exchange and secure connectivity for customer-facing services.
• Enterprise PKI and certificate lifecycle: Modernize CA hierarchy, certificate profiles, issuance workflows and CLM integrations.
• Code signing and firmware signing: Protect software supply chain trust with PQC-ready signing strategy and stronger governance.
• VPN, remote access and secure tunnels: Assess protocol and product readiness for quantum-safe key establishment.
• HSM, KMS and key lifecycle governance: Map key ownership, usage, rotation, archival and destruction controls across platforms.
• Long-lived sensitive data: Prioritize data requiring confidentiality beyond the expected quantum risk horizon.

Key challenges and recommended mitigations

HCLTech point of view

• Enterprises should treat PQC as a business resilience and governance program, not only as a cryptographic algorithm change.
• The first priority is visibility: without a trusted CBOM, organizations cannot quantify exposure, prioritize migration or demonstrate progress to auditors and leadership.
• PKI should evolve into a PQC-enabled trust platform with crypto-agility, automated certificate lifecycle management, HSM/KMS governance and integration with ITSM workflows.
• Hybrid cryptography will be an important bridge where standards, products and interoperability mature at different speeds across the enterprise ecosystem.

Conclusion: Modernize trust before quantum becomes an emergency

The future is not about replacing PKI; it is about modernizing PKI into a quantum-safe, crypto-agile trust architecture. Enterprises that start early can reduce long-term risk, avoid rushed compliance-driven remediation and create lasting operational maturity across cryptographic assets.

Final thought: The key question is no longer whether quantum computing will challenge today’s cryptography. The key question is whether the enterprise will have the visibility, governance and agility to respond before that risk becomes business-critical.

References and further reading

• NIST Post-Quantum Cryptography Project