The Quantum-Safe Transition Starts with Visibility: How CBOM Secure Puts Frost & Sullivan’s CISO Insights into Practice

You cannot migrate cryptography you cannot see. That is the uncomfortable starting point for most post-quantum programs, and it is the problem at the center of Frost & Sullivan’s new report, Insights for CISOs: Transition to Quantum-Safe. 

The report finds that cryptographic assets are spread across networks, endpoints, applications, source code, certificates, key management systems, and hardware security modules (HSMs), so there is rarely a single source of truth. It also finds that discovery is proving considerably more complex than many organizations initially expected. Meanwhile the clock is moving: in March 2026, Google brought its own post-quantum cryptography (PQC) deadline forward to 2029. 

Frost & Sullivan profiles CBOM Secure, Encryption Consulting’s cryptographic discovery and inventory platform, as the visibility layer of its approach to PQC migration. This post walks through what the report says a usable cryptographic inventory requires, and how CBOM Secure delivers it. Download the full report here. 

Key takeaways 

• Frost & Sullivan identifies cryptographic visibility as the foundation of PQC migration: organizations need to find cryptographic assets, control them through policy, and automate their lifecycle. 

• A useful inventory maps dependencies between certificates, keys, HSMs, and the applications and business processes that rely on them, then prioritizes by risk. 

• CBOM Secure discovers cryptographic assets across cloud, HSMs, databases, source code, and secret vaults, maps their relationships, and turns findings into migration plans. 

• Leading organizations start with a defined perimeter and run discovery, control, and migration in parallel instead of waiting for a complete inventory. 

• PQC maturity is entering private equity due diligence, which makes a defensible cryptographic inventory a business asset as well as a security one. 

Why visibility is the first quantum-safe deadline 

The quantum threat timeline is compressing because attack algorithms are becoming more efficient at the same time that quantum hardware improves. On March 31, 2026, Google Research published estimates showing that the 256-bit elliptic-curve cryptography protecting major cryptocurrencies could be broken with fewer than 500,000 physical qubits, roughly a 20-fold reduction from earlier estimates (Google Research). Google also set 2029 as the target for its own full transition to PQC. 

Frost & Sullivan reads that move as a signal rather than a forecast: leading technology companies are planning against a shorter window. For enterprises, the problem is that migration is a multi-year effort, and every step of it, from assessing exposure to replacing vulnerable implementations, depends on first knowing where cryptography lives. For a closer look at the Google announcement, see what Google’s 2029 deadline means for your organization. 

Regulators are turning that urgency into dates. Frost & Sullivan summarizes the key milestones: 

Jurisdiction / framework	PQC milestones
CNSA 2.0 (US)	2030: transition to PQC for encryption; 2031: transition to PQC for digital signing
European Commission	2026: start transition to PQC; 2030: coordinated implementation roadmap for transition to PQC
Australian Signals Directorate	2030: RSA no longer approved for use
United Kingdom	2031: critical upgrades; 2035: complete migration
CSA Singapore	2027: migration plan; 2031: critical information infrastructure (CII) completes migration

Source: Frost & Sullivan, Insights for CISOs: Transition to Quantum-Safe (Exhibit 1). 

The report notes that financial institutions in particular are being asked to show regulators that they have started identifying cryptographic assets, assessing exposure, and building migration plans. In practice, that means the first piece of evidence a regulator will ask for is an inventory. You can track the mandates that apply to you with our PQC Compliance Mandate Tracker. 

What Frost & Sullivan says a usable cryptographic inventory needs 

According to the report, organizations making real progress treat PQC as a program of cryptographic discovery, control, automation, and infrastructure modernization, built around three capabilities: finding cryptographic assets, controlling them through policy, and automating their lifecycle management. The report is specific about what the “finding” part demands. 

It has to go beyond algorithms 

A list of algorithms does not tell you what will break. An application may depend on certificates issued by a public key infrastructure (PKI), which in turn relies on HSMs, while network components add more dependencies. Frost & Sullivan says organizations need to understand what cryptography they have, where it sits, and which applications, data, and business processes depend on it. A Cryptographic Bill of Materials (CBOM) is the structure that captures that context. If you are new to the concept, start with why CBOM is essential. 

It has to be prioritized by risk 

A non-compliant algorithm protecting a low-value application is a very different problem from the same algorithm protecting sensitive data or a critical business process. The report recommends combining cryptographic inventories with risk assessments and dependency mapping, and warns that there is no one-size-fits-all risk-scoring framework. A bank and a healthcare provider will prioritize different assets. 

It has to start before it is finished 

For large enterprises, discovery at scale can take several years. Frost & Sullivan found that leading organizations no longer treat a complete inventory as a prerequisite. They define a contained perimeter, test discovery, crypto-agility, and remediation inside it, and build the integrations and governance needed to scale at the same time. 

It has to fit the tools you already run 

The report advises CISOs to integrate PQC capabilities with existing security, endpoint, network, and cryptographic-management platforms rather than deploying yet another standalone scanner or sensor. It also notes that no single vendor is likely to cover the entire estate. 

How CBOM Secure puts the report’s guidance into practice 

CBOM Secure is built around the same sequence the report describes: discover cryptographic assets, correlate them with what depends on them, and govern them through policy over time. 

Discover 

CBOM Secure uses 20+ sensors to discover cryptographic assets across networks, source code, databases, applications, and secret vaults, creating a unified inventory of an organization’s cryptographic environment. That coverage includes cloud key management in AWS, Azure, and Google Cloud; HSMs through PKCS#11 and KMIP; transparent data encryption keys in Oracle, Microsoft SQL Server, and MySQL; TLS endpoints; Active Directory and LDAP directories; HashiCorp Vault; and source code repositories. CBOM Secure extracts key metadata from HSMs and databases without touching private key material, and the report adds that the platform protects sensitive data throughout discovery so visibility does not introduce new data-leak risk. 

Correlate 

This is where the report’s “beyond algorithms” requirement is met. CBOM Secure maps relationships and dependencies between assets, including links between certificates and keys, cross-service dependencies, and instances of key reuse. It scores every asset for risk, flags weak ciphers and expiring certificates, and assesses crypto-agility and quantum readiness at the host level. Classical asymmetric algorithms such as RSA, ECDH, and ECDSA are tagged automatically as quantum-vulnerable, so they surface for migration planning as discovery runs. 

Govern 

Findings only matter if they reach the people who can fix them. CBOM Secure translates discovery results into actionable migration plans and tracks progress toward quantum-safe adoption. Policy is evaluated continuously against standards including NIST guidance, FIPS 140-3, and CNSA 2.0, with dashboards, proactive alerts, and on-demand audit reports for ongoing oversight. A cryptographically verifiable audit trail records what changed, when, and by whom, and full inventories export in CycloneDX format for use in other security and compliance tools. 

Built to fit your environment 

CBOM Secure supports on-premises, cloud, hybrid, and SaaS deployment, with agentless and agent-based discovery options. According to Frost & Sullivan, integrations with ServiceNow send findings to application owners for remediation, while endpoint and security platforms such as Tanium and CrowdStrike can support sensor deployment at scale. That answers the report’s warning about tool sprawl directly: cryptographic discovery and remediation run inside the workflows your teams already use. 

CBOM Secure and the four insights for CISOs 

The report closes with four insights for security leaders. Each one depends on a reliable inventory. 

Frost & Sullivan insight	What it means for your inventory	How CBOM Secure helps
PQC requires a multi-vendor, data-centric approach	The risk sits with the data and the keys protecting it, which move across clouds, platforms, and vendors	Discovers keys and certificates across multi-cloud KMS, HSMs, databases, and vaults, and flags the same key appearing in more than one place
Fund PQC through programs that already have money	Early pilots need to produce a bill of materials, cost estimates, and a roadmap	A perimeter-scoped CBOM gives you the asset counts, risk scores, and dependency map to size the next budget request
Tailor the migration to your organization	Risk scoring must reflect your data, regulators, and business context	Risk scoring and policy evaluation, combined with Encryption Consulting’s advisory expertise, prioritize what needs attention now and what can wait
PQC maturity is becoming a valuation issue	Investors want evidence of cryptographic visibility and a credible migration plan	Produces a complete cryptographic inventory with prioritized risk findings across an acquired environment within hours

The budget side matters too. Frost & Sullivan breaks PQC spending into nine areas: enterprise integration, network infrastructure, applications, platforms and environments, PKI and key management, data and storage, DevSecOps, third-party vendors, and governance and compliance. Discovery and governance cut across almost every one of them, which is why the inventory is usually the first line item to fund. Our CBOM ROI calculator helps put numbers in front of your board. 

Our take: start with a perimeter, not a perfect inventory 

We agree with the report’s central point. In our experience, waiting for a complete enterprise inventory before migrating is one of the most common reasons PQC programs stall. Here is what we would recommend to a CISO starting or restarting a program today. 

1. Name an owner and a perimeter in the same meeting: Pick one business-critical system with a manageable number of vendors and treat it as your first migration track. 

2. Run CBOM Secure on that perimeter first: Map certificates, keys, HSMs, libraries, and the applications and data that depend on them. Score risk by data sensitivity and regulatory exposure, not algorithm alone. 

3. Use the pilot to write the business case: The bill of materials, effort estimates, and lessons learned from the first perimeter are what make the second budget request credible. Our guide to PQC program governance roles and responsibilities covers how to structure ownership. 

4. Push PQC into procurement now: Every new device, platform, and SaaS contract signed this year should carry PQC-readiness requirements. 

5. Keep the inventory running: Treat discovery, remediation, and reassessment as a continuous cycle so your CBOM reflects the estate you have today, not the one you audited last year. 

Where teams need help beyond the platform, our PQC Advisory Services support assessment, strategy, and implementation. Frost & Sullivan describes this combination of technology and specialist guidance as designed to bridge the expertise gap around PQC and CBOM. 

Conclusion 

Every quantum-safe roadmap rests on the same foundation: knowing what cryptography you have, where it lives, and what depends on it. Frost & Sullivan’s Insights for CISOs: Transition to Quantum-Safe makes clear that timelines are compressing, regulators have published dates, and investors are starting to price cryptographic risk. The organizations that finish on time will be the ones that build that visibility now, inside a defined perimeter, and keep it current as the migration scales. 

Download the full report to read Frost & Sullivan’s complete analysis, including its profile of CBOM Secure. 

Ready to see your cryptography clearly? Request a CBOM Secure demo or talk to our PQC advisory team. Not ready for a call yet? Start with our Quantum Readiness Assessment. 

Frequently asked questions 

What does the Frost & Sullivan report say about CBOM Secure? 

Frost & Sullivan’s Insights for CISOs: Transition to Quantum-Safe profiles CBOM Secure as the visibility layer of Encryption Consulting’s approach to PQC migration. The report describes how the platform discovers cryptographic assets across networks, source code, databases, applications, and secret vaults, maps their dependencies, and turns findings into actionable migration plans. 

Why does PQC migration start with cryptographic discovery? 

Organizations cannot replace vulnerable cryptography they have not found. Frost & Sullivan notes that cryptographic assets are spread across networks, endpoints, applications, source code, certificates, key management systems, and HSMs, with rarely a single source of truth. A dependency-aware inventory shows what is vulnerable, what depends on it, and what to fix first. 

What is a Cryptographic Bill of Materials (CBOM)? 

A Cryptographic Bill of Materials is a structured inventory of the cryptographic assets an organization uses, including keys, certificates, algorithms, and protocols, along with where they live and what depends on them. CBOM Secure builds and maintains this inventory continuously and exports it in the CycloneDX format. 

Do organizations need a complete inventory before starting PQC migration? 

No. Frost & Sullivan found that leading organizations work on visibility, control, and implementation in parallel. They start with a defined perimeter, test discovery, crypto-agility, and remediation there, and build the governance and integrations needed to scale at the same time. Waiting for a complete enterprise inventory can delay meaningful progress by years. 

Does CBOM Secure work with existing security tools? 

Yes. CBOM Secure supports on-premises, cloud, hybrid, and SaaS deployment with agentless or agent-based discovery, and exports inventories in CycloneDX format. Frost & Sullivan also highlights integrations with ServiceNow for routing findings to application owners and with platforms such as Tanium and CrowdStrike for deploying sensors at scale.