What Should You Ask a PQC Vendor? A Practical Evaluation Checklist

Over the last eight episodes, I walked through how to approach a PQC migration: visibility, context, prioritization, dependencies, ownership, backlog, planning, and continuous agility. This bonus episode is for the moment you're ready to start evaluating vendors.

What should you actually ask them?

Don't stop at "can you make me quantum safe?"

That question is too thin. Almost every vendor will say yes in some form. The useful evaluation is whether they can help you build the operational capability the rest of this series described: crypto agility.

I'd start with discovery, then move through context, prioritization, blockers, remediation, and what happens after the first migration wave.

1. What can you actually discover?

Ask what the product can find across your environment. Certificates and keys are table stakes. Push further:

• Algorithms and protocols in use
• Cryptographic libraries
• How discovery works in practice (agent, network, integrations, scans)
• What it systematically misses

Finding cryptography is only the beginning. A partial inventory creates a false sense of readiness.

2. Can you tell me what that cryptography is connected to?

A list of assets does not tell you what to do first. Ask:

• What application uses this crypto?
• What business service does it support?
• Who owns it?
• What depends on it if we change it?

Without that context, you have an inventory, not a migration program. This is where full cryptographic inventory differs from certificate-only tools. You need relationships, not just objects.

3. How do you prioritize?

Ask them to show how they separate "vulnerable" from "vulnerable and important."

Technical severity alone is not enough. You need business exposure, operational criticality, and dependency weight. If prioritization is a spreadsheet export and a shrug, you will stall the moment the list gets long.

4. What happens when something can't migrate?

This is where evaluations get practical. Real environments include assets that cannot move on a clean schedule:

• The application does not support quantum-safe cryptography yet
• A commercial vendor is not ready
• A library needs a change
• The application itself may need replacement

Can the solution help you understand those options and build them into a migration plan? Temporary risk acceptance, vendor chase items, code work, and escalations all belong in the same backlog. If the product only models "ready to swap," it will not survive contact with production.

5. How does remediation actually happen?

Once you decide to change something, ask how the change executes:

• Through their product?
• Through your existing infrastructure?
• Through your PKI or certificate lifecycle management system?
• Or does someone need to modify the application itself?

Those are different operating models with different owners, risk profiles, and timelines. Get a clear answer before you buy a narrative that stops at "we flag the issue."

6. What happens after the migration?

This question gets overlooked. Cryptography keeps changing. Standards evolve. New systems appear. Libraries update. Risk returns.

Ask whether the platform can continuously tell you when new cryptographic risk shows up. A one-time migration project without ongoing discovery and adaptation is a temporary cleanup, not crypto agility.

The evaluation frame that matters

When you evaluate PQC vendors, do not stop at "can you make me quantum safe?"

Ask them to show how they help you:

• Discover
• Understand (context and ownership)
• Prioritize
• Migrate (including blockers and remediation paths)
• Continuously adapt

That sequence is the capability you are trying to build. For how Axiad approaches this with enterprise and federal customers, see our PQC Readiness page, or run a quick external check on quantum.axiad.io.

One more bonus episode is coming: who actually owns quantum readiness. Your cloud provider can migrate its infrastructure. Your vendors can migrate their products. Neither of them can migrate your enterprise for you.

The PQC Playbook Series

Previous: Episode 8: When Is a PQC Migration Actually Finished?
Next: Episode 10: Who Actually Owns Quantum Readiness?