Your own PQC migration can be flawless and you can still get burned by a vendor’s TLS certificate sitting on a legacy algorithm you don’t control.
Third-party risk just got a quantum lens. On October 21, Black Kite added “Quantum Readiness” controls to its Cyber Rating engine — one of the first times a major third-party risk platform has started scoring vendors on post-quantum posture, not just patch cadence and breach history.
What it checks: Hybrid PQC key exchange visible in live TLS handshakes, PQC-ready certificate signatures, and legacy RSA/ECDSA/ECDH assets with no migration path in sight.
Why now: The regulatory clock isn’t just yours anymore. OMB M-26-15 sets federal key-establishment migration by 2030 and signature migration by 2031; EO 14412 holds covered contractors to the same post-quantum standards by December 31, 2030; NIST’s deprecation schedule phases out RSA/ECDSA/ECDH starting 2030 and disallows them outright by 2035. If your vendors miss those dates, their exposure becomes yours.
The limit worth naming: external scoring can only see what’s observable from outside — the handshake, the cert chain. It can’t see the code library, the KMS, the HSM, or the internal service mesh still signing with RSA behind the firewall. As Protiviti’s Konstantinos Karagiannis put it, “cryptographic migrations take years” — an outside-in score tells you where a vendor’s perimeter stands, not whether their actual crypto inventory is complete.
Bottom Line: Crypto agility stopped being a one-organization problem. Pair outside-in vendor scoring with an accurate internal CBOM — code, network traffic, KMS, HSM, PKI — so your own answer to “are we ready” isn’t guesswork either. That’s the discovery layer QuantVision was built for.
How is your third-party risk program adapting to score vendors on quantum readiness — and would you trust what you’d find if someone scored you the same way?
#PostQuantumCryptography #PQC #ThirdPartyRisk #CryptoAgility #CISO #SupplyChainSecurity #NIST #QuantumSafe #InfoSec