What Should You Ask a PQC Vendor? A Practical Evaluation Checklist

Over the last eight episodes, I walked through how to approach a PQC migration: visibility, context, prioritization, dependencies, ownership, backlog, planning, and continuous agility. This bonus episode is for the moment you're ready to start evaluating vendors.

What should you actually ask them?

Don't stop at "can you make me quantum safe?"

That question is too thin. Almost every vendor will say yes in some form. The useful evaluation is whether they can help you build the operational capability the rest of this series described: crypto agility.

I'd start with discovery, then move through context, prioritization, blockers, remediation, and what happens after the first migration wave.

1. What can you actually discover?

Ask what the product can find across your environment. Certificates and keys are table stakes. Push further:

Finding cryptography is only the beginning. A partial inventory creates a false sense of readiness.

2. Can you tell me what that cryptography is connected to?

A list of assets does not tell you what to do first. Ask:

Without that context, you have an inventory, not a migration program. This is where full cryptographic inventory differs from certificate-only tools. You need relationships, not just objects.

3. How do you prioritize?

Ask them to show how they separate "vulnerable" from "vulnerable and important."

Technical severity alone is not enough. You need business exposure, operational criticality, and dependency weight. If prioritization is a spreadsheet export and a shrug, you will stall the moment the list gets long.

4. What happens when something can't migrate?

This is where evaluations get practical. Real environments include assets that cannot move on a clean schedule:

Can the solution help you understand those options and build them into a migration plan? Temporary risk acceptance, vendor chase items, code work, and escalations all belong in the same backlog. If the product only models "ready to swap," it will not survive contact with production.

5. How does remediation actually happen?

Once you decide to change something, ask how the change executes:

Those are different operating models with different owners, risk profiles, and timelines. Get a clear answer before you buy a narrative that stops at "we flag the issue."

6. What happens after the migration?

This question gets overlooked. Cryptography keeps changing. Standards evolve. New systems appear. Libraries update. Risk returns.

Ask whether the platform can continuously tell you when new cryptographic risk shows up. A one-time migration project without ongoing discovery and adaptation is a temporary cleanup, not crypto agility.

The evaluation frame that matters

When you evaluate PQC vendors, do not stop at "can you make me quantum safe?"

Ask them to show how they help you:

That sequence is the capability you are trying to build. For how Axiad approaches this with enterprise and federal customers, see our PQC Readiness page, or run a quick external check on quantum.axiad.io.

One more bonus episode is coming: who actually owns quantum readiness. Your cloud provider can migrate its infrastructure. Your vendors can migrate their products. Neither of them can migrate your enterprise for you.

The PQC Playbook Series