Long-lived data can be captured now
Legal, financial, health and intellectual-property data can be collected today and targeted for decryption in the future.
The migration clock is already running
Quantum computers will threaten today’s cryptography. Find where to start.
Post-quantum cryptography (PQC) is a set of new standards for ordinary computers, designed to resist attacks from future quantum computers. The transition starts with a clear view of today’s cryptography, its owners and the migration decisions that matter first.
Cryptographic inventoryIllustrative data
Scope
one approved product
Owner-validated findings
2
representative repos
3
approved TLS endpoints
1
certificate export
AssetCryptoStatus
Release signingRSA-2048Confirmed
Product backendECDSA P-256Owner review
Device identityVendor managedVendor question
Illustrative inventory view — not a live customer scan
2026
EU roadmap: planning and pilots begin
2030
High-risk use cases targeted
2035
Medium-risk use cases targeted
Coordinated roadmap for EU Member States; company obligations depend on sector and applicable regulation.
ML-DSA (FIPS 204)RSA-2048RSA-4096ECDHE P-256X25519ECDSAEd25519ML-KEM (FIPS 203)SLH-DSA (FIPS 205)X.509 / PKI
The business problem
Waiting for a confirmed cryptographic breakthrough leaves no migration window.
PQC migration touches identity, certificates, vendors, archives, products and procurement. Without a current inventory, leadership cannot see cost, ownership or sequencing.
Why act now
The risk does not begin only when a sufficiently powerful quantum computer arrives. Data captured now may remain sensitive for years, while complex products and supply chains take years to migrate.
Migration takes years
Critical systems, embedded devices, trust chains and vendor dependencies cannot be replaced in one maintenance window.
Inventories are often fragmented
Cryptography is spread across certificates, code, cloud services, hardware and third parties — often without a clear owner.
Evidence, not hype
Governments, standards bodies and technology leaders are already acting.
The deadlines are becoming concrete, the standards are published and platform providers have multi-year programs underway.
DORA · EU 2024/1774
For financial entities in scope of DORA, cryptographic governance is already an explicit control obligation.
DORA itself does not name post-quantum cryptography. Its supporting Delegated Regulation (EU) 2024/1774 requires a policy on encryption and cryptographic controls, provisions to update cryptographic technology as cryptanalysis evolves, and a current register of certificates and certificate-storing devices for critical or important functions.
Articles 6 and 7. This is not PQC certification; it does make an unknown or stale cryptographic inventory a governance problem today.
Policy and standards
Technology signals
From uncertainty to a decision
Give leadership a roadmap, not another technical backlog.
PQC Radar turns scattered cryptographic signals into a prioritized business view your security, risk, architecture and procurement teams can act on.
Cryptographic inventory
A defensible starting map of algorithms, certificates, protocols, libraries and critical dependencies.
Know what exists, where it sits and who owns it.
Prioritized business risk
Exposure ranked by data lifetime, business criticality, external reach and migration difficulty.
Fund the work that reduces the most risk first.
30 / 60 / 90-day roadmap
Clear decisions, owners, vendor questions, quick wins and validation steps for the next quarter.
Move from awareness to governed execution.
Data boundary
One approved product. Controlled data boundary.
A typical scope can include two representative repositories, approved TLS endpoints, a certificate export and one signing or update workflow. Analysis runs locally; source code is not uploaded. Evidence is redacted and validated with product owners.
- No private keys or tokens in outputs
- Heuristic discovery, clearly marked for validation
- Not a penetration test, CVE scan or certification
PQC Readiness Sprint
A focused first step for enterprise teams.
In two weeks, we establish the initial evidence base, align stakeholders and produce an executive-ready migration plan — without pretending it is a complete cryptographic audit.
Typical fixed-scope pilot: €6,000–€12,000 excl. VAT, confirmed after scoping.
- Leadership and technical scoping
- Initial discovery and inventory
- Business-risk prioritization
- Executive report, CBOM-style export and 30/60/90 plan
Named accountability
Clear responsibility from the first call to the final readout.
Viktor Vítovec
Operator · Product and technical lead
PQC Radar is operated by Viktor Vítovec, a Czech software and digital-product developer. He is directly responsible for scoping, delivery and client communication; findings are reported conservatively and separated from items that still require manual validation.
- Czech sole trader · IČO 23929553
- Software and digital-product development
- Direct responsibility for scope and delivery
Before any access
A controlled engagement, agreed in advance.
- 01
Reply within one business day
A practical next step, not an automated sales sequence.
- 02
Scope and safeguards
Approved inputs, data boundary and fixed scope; NDA or DPA available when needed.
- 03
Authorized delivery
Local analysis, redacted evidence and an executive readout with clear limitations.
Start with your highest-risk question
Find out where your migration should begin.
Tell us what is driving the conversation — regulation, customer pressure, long-lived data or an unknown inventory. We will reply with a practical next step.