What Will Break and What Will Remain?
PQC risk becomes practical when vulnerable cryptography appears inside real systems such as TLS, VPNs, certificates, PKI, code signing, and identity infrastructure.
System Impact, Not Everything Breaking
Post-quantum migration is about finding where vulnerable cryptography sits inside real systems.
Needs attention
These often depend directly on public-key cryptography that will need a migration path.
May need vendor or configuration changes
The system may remain usable, but support depends on configuration, vendor roadmap, or platform capability.
Mostly remains usable
They may not be replaced because of PQC, but the cryptography protecting them still needs review.
Not directly affected
These parts do not become quantum-risk items by themselves, but they may rely on affected infrastructure.
PQC migration is not about everything breaking at once. It is about finding where vulnerable cryptography sits inside real systems.
Short Answer
Post-quantum risk does not mean that every system suddenly stops working.
Not everything breaks at once
The practical issue is that many real systems depend on public-key cryptography for trust, identity, key exchange, certificates, and signatures.
Some of those cryptographic mechanisms will need replacement, upgrade, configuration changes, or vendor support.
Dependencies need review
Other parts of the system may remain usable, but still depend on cryptographic libraries, certificates, protocols, or supplier roadmaps.
Start with visibility
The first step is not to replace everything. The first step is to understand what depends on what.
Core Explanation
Cryptography is hidden inside systems
Most people do not manage cryptography directly.
They manage systems that use cryptography.
This is why PQC readiness is partly a visibility problem.
- websites
- VPNs
- APIs
- identity platforms
- cloud services
- network appliances
- software update systems
- document-signing workflows
- backups and archives
Some systems need direct attention
Systems that use vulnerable public-key cryptography for key exchange, identity, or signatures need attention.
These systems may need new algorithms, hybrid transition support, vendor updates, testing, or replacement planning.
- TLS and HTTPS configurations
- VPN platforms
- PKI and certificate infrastructure
- code-signing systems
- software update mechanisms
- identity federation and SSO
- device and firmware trust chains
Some systems are affected indirectly
A system may not “do cryptography” as its main purpose, but it may depend on cryptography through libraries, certificates, APIs, cloud services, managed platforms, supplier products, hardware modules, or embedded firmware.
This indirect dependency is why inventory work matters.
Some parts remain usable, but still need review
Post-quantum migration does not mean every database, application, backup, or device must be thrown away.
Many systems remain useful.
The review question is: Which cryptographic dependency inside this system must change, and who controls that change?
Why It Matters
This page is the bridge from basic concepts to practical readiness.
After learning which algorithm families are at risk, the next question is system impact.
A company needs to know whether vulnerable cryptography is used in customer-facing services, employee remote access, internal APIs, identity systems, supplier platforms, software signing, product firmware, long-term archives, and regulated or long-lifecycle systems.
Without that visibility, migration planning becomes guesswork.
Practical Example
Will our customer portal break?
A company asks: “Will our customer portal break?”
The honest answer is: probably not suddenly.
But the portal may depend on:
So the better question is: Which cryptographic dependencies protect the portal, and which of them will need a migration path?
That answer may involve several teams and suppliers, not only the web team.
Careful Analogy
PQC migration can feel a little like a broad infrastructure transition. Like Y2K, it affects many hidden dependencies across systems.
Unlike Y2K, there is no precise calendar date when everything changes at once. The analogy is useful for understanding scope, not for predicting timing.
Common Misunderstanding
“On Q-Day, everything encrypted will suddenly break.”
Some public-key cryptographic mechanisms will need migration, and many real systems depend on them. But impact depends on where cryptography is used, how systems are configured, which vendors control them, and how long the protected data must remain confidential.
What to Remember
One-Sentence Summary
PQC impact is a system-dependency problem, not a simple “everything breaks” event.
Three Key Points
- TLS, VPNs, PKI, certificates, signatures, code signing, and identity systems need attention.
- Many business systems remain usable but may depend on cryptography that needs review.
- Inventory and discovery are the practical bridge between algorithm risk and action.