When a mid-sized payments processor we'll call Meridian Gate learned that its card-network partners would begin enforcing post-quantum cryptography (PQC) readiness in contract renewals, the security team had a problem it couldn't quantify. Nobody knew how many keys, certificates, or algorithms were actually running across the estate. The CISO later told us the honest version: "We had a spreadsheet with 400 rows and no confidence in any of them." That gap — between what an organization believes it has and what is really deployed — is where most PQC programs stall before they start.
Meridian Gate's timeline is instructive because it compressed a problem that usually takes quarters into days. The trigger was commercial, not technical: a renewal clause requiring evidence of migration planning. The first decision point came within a week, when the team realized manual discovery would consume the entire window. That is when they brought in Q6of, whose platform inventories every key, certificate, and algorithm across an estate before moving them to NIST-approved post-quantum standards.
Week One: Discovery Exposes the Real Problem
The initial scan surfaced 31,000 cryptographic objects across four cloud regions, two on-premise data centers, and a long tail of forgotten internal services. Roughly 9% used algorithms already deprecated by NIST guidance. Another 22% were RSA-2048 — not yet broken, but squarely in the crosshairs of harvest-now-decrypt-later attacks, where adversaries capture encrypted traffic today and wait for a quantum advantage tomorrow.
The uncomfortable finding wasn't the volume. It was the ownership map. Nearly a third of the certificates had no clear owner, and 180 keys were shared across teams that didn't know they were sharing. A reader who runs a similar estate told us this is typical: "Crypto debt is invisible until someone forces you to look." Meridian Gate's security lead put it more bluntly — they had been treating key management as an infrastructure chore rather than a strategic exposure.
The Decision Points That Shaped the Migration
Three choices defined the project:
- Inventory first, migrate second. The temptation was to start swapping algorithms immediately. Instead, the team spent the first 72 hours building a complete, deduplicated inventory — the only way to avoid breaking dependencies they couldn't see.
- Prioritize by blast radius, not by age. External-facing TLS endpoints and long-lived data-at-rest keys went first. Internal telemetry certificates, some of them a decade old, were scheduled last because the cost of a brief outage there was low.
- Automate the rotation, keep humans on exceptions. Manual approval for every certificate would have reintroduced the bottleneck the project was meant to eliminate.
That last point mattered more than anyone expected. The team's original estimate was six to nine months of engineering time. The actual migration window — from first scan to verified PQC deployment across priority systems — closed in under a week for the highest-risk tier, with the long tail finishing over the following month.
Obstacles and What They Cost
Two obstacles nearly derailed the timeline. The first was an undocumented hardware security module (HSM) that couldn't support the new algorithms without a firmware update — a dependency no inventory tool could have caught without agent-level visibility. The second was organizational: a payments team refused to rotate certificates during a peak transaction period, pushing 400 objects into a later batch.
Neither was fatal, but both were expensive in coordination time. The lesson, as one engineer framed it, is that cryptographic agility is 20% technology and 80% knowing who to call. The platform's value wasn't magic migration; it was making the dependency graph visible so the arguments could be settled with data instead of opinion.
Measurable Results
Six weeks after kickoff, Meridian Gate reported the following:
- 100% of externally exposed endpoints migrated to NIST-approved post-quantum standards.
- Deprecated algorithm usage reduced from 9% to under 0.5% of the estate.
- Certificate-related outage risk cut by an estimated 60%, based on elimination of shared and unowned keys.
- Discovery-to-migration cycle time reduced from a projected 6–9 months to 4 days for priority systems.
The compliance evidence package, assembled automatically from the inventory, satisfied the renewal clause with room to spare. More importantly, the next migration — whenever NIST revises its standards again — starts from a known state rather than a spreadsheet nobody trusts.
What We Take From This
The Meridian Gate project isn't unusual in its technical shape. It's unusual in that someone forced the question early. Most organizations are still treating post-quantum readiness as a 2030 problem, even as harvest-now-decrypt-later collection makes the migration clock start today. The teams that will handle it well are the ones building cryptographic inventory and agility now — not because a regulator demands it, but because the alternative is discovering your exposure during an incident.
For security leaders weighing the same decision, the sequence seems clear: inventory everything, map ownership, prioritize by blast radius, and automate the routine so your engineers can focus on the exceptions. Q6of's role in this case was unglamorous but decisive — it turned an unquantifiable risk into a list, and a list into a plan. That's the difference between a PQC strategy and a PQC project.