Back to DashboardApplicationsPhase 1 · Discovery & Inventoryadvanced80 min

Platform Engineering & PQC

Inventory, migrate, and monitor every cryptographic primitive in your software delivery pipeline — CI/CD crypto assets, container signing, IaC defaults, policy enforcement, and posture monitoring with a quantum threat lens.

Why this matters: CI/CD pipelines and container images are full of cryptographic defaults nobody chose deliberately — IaC and policy-engine enforcement (OPA/Kyverno) are how you find and fix them before they ship, not after.

Start here: Compare OCI signing tools in Container Signing Migration and walk the ECDSA-to-ML-DSA path for cosign and Notation.

For your role

Developer / Engineer: Inventory every cryptographic primitive in the CI/CD pipeline, compare OCI artifact signing tools by PQC readiness, and write the OPA and Kyverno rules that block quantum-vulnerable algorithm OIDs.
Security Architect: The Quantum Threat Timeline models HNDL risk per pipeline asset under different CRQC arrival years; the Policy-as-Code Enforcer is where the architecture's algorithm decisions become enforceable.
Researcher / Academic: The four-panel Crypto Posture Monitor (Prometheus metrics, SIEM queries, capacity) shows what a measured pipeline posture looks like; the signing-tool comparison records current PQC readiness.
IT Ops / DevOps: The Crypto Posture Monitor and the container-signing migration are the operational pieces; the pipeline inventory in Step 1 finds the defaults nobody chose deliberately.

Practice in the Simulation

Every layer of the software delivery pipeline embeds classical cryptography: ECDSA P-256 signing keys for container images, RSA-2048 certificates for TLS sessions to Vault and the Kubernetes API server, and HMAC-SHA-256 for webhook secrets. A cryptographically relevant quantum computer (CRQC) running breaks all public-key schemes currently used in CI/CD infrastructure.

Broken by Shor's

• ECDSA P-256 / P-384 (signing)
• RSA-2048 / RSA-4096 (signing, KEX)
• ECDH / ECDHE (key exchange)
• Ed25519 / Ed448 (signing)
• DH / DHE (key exchange)

Weakened by Grover's

• AES-128 → 64-bit effective security
• SHA-256 → 128-bit pre-image security
• HMAC-SHA-256 → still safe (128-bit)
• AES-256 → 128-bit effective (safe)

Quantum-Safe

• (FIPS 204)
• (FIPS 203)
• (FIPS 205)
• AES-256 (symmetric)
• HMAC-SHA-256 / SHA-384

The Harvest-Now-Decrypt-Later (HNDL) Threat

Adversaries are recording encrypted TLS sessions today — Vault mTLS, kube-apiserver traffic, registry pulls — and storing them for decryption once a CRQC is available. Even if your certificates expire in 90 days, the data they protected may remain sensitive for 10–20 years. This makes TLS key exchange (ECDHE) the most critical asset to migrate, ahead of signing keys.

Products shown here are a representative selection — not an exhaustive list. For the full vendor landscape with PQC readiness status, visit the Tools & Products tab in this module or browse the Migrate catalog →

Ready to audit your platform crypto?

Inventory your CI/CD pipeline crypto assets, migrate container signing to ML-DSA, and enforce PQC policy across your Kubernetes cluster in the interactive workshop.