Post-Quantum Cryptography (PQC) Crypto-Agility Selling to the CISO and Chief Cryptographer — 60-Min Training

Question

Pulse RevOps · The Machine · Accepted Answer

### Direct Answer

> **Post-Quantum Cryptography (PQC) Crypto-Agility Selling to the CISO and Chief Cryptographer** is a 60-minute training for AEs, SEs, and channel managers running $150K–$1.8M ACV cycles against incumbents like **DigiCert**, **Entrust**, **PQShield**, **Crypto4A**, **ISARA** (Quantinuum), **InfoSec Global**, **Cellcrypt**, **Fortanix**, **Sectigo**, **AppViewX CERT+**, and **Venafi** (CyberArk). The session teaches sellers to qualify against the **three-buyer reality (CISO, Chief Cryptographer, Compliance Officer)**, run a structured discovery on **harvest-now-decrypt-later (HNDL) risk economics**, demo against the customer's actual cryptographic inventory, and trap-set the multi-year renewal at month 18. Built on **MEDDPICC**, **Force Management's Command of the Message**, and **Andy Paul's "Sell Without Selling Out"** discovery cadence.

---

## Section 1 — Why Post-Quantum Cryptography Selling Is Different (5 min)

Open the room by killing the SaaS-seller default. PQC selling is **regulator-driven and physics-driven**. The **National Security Memorandum 10** (NSM-10) and **OMB Memorandum M-23-02** require federal agencies to inventory cryptography by 2024 and migrate by 2035. **NIST FIPS 203, 204, 205** finalize the new algorithms.

Set the frame on the whiteboard.

- **Three buyers, one regulatory clock.** CISO funds; Chief Cryptographer picks; Compliance Officer reports to the regulator. **NSM-10** drives federal and federal-contractor demand.
- **Harvest-now-decrypt-later is the active threat.** Adversaries are harvesting encrypted data today to decrypt with future quantum computers. **20-year data sensitivity** (defense, IP, healthcare) is at immediate HNDL risk.
- **Crypto-agility is the architecture, not the algorithm.** **DigiCert** and **PQShield** lead on crypto-agility platforms that allow swapping algorithms without app rewrites.

End the segment with **Mark Roberge's** rule: *"Sell the crypto-agility platform, not the algorithm selection."*

---

## Section 2 — The 60-Minute Discovery Block (15 min)

> 1. **Opening (3 min):** "Walk me through your cryptographic inventory project — algorithms in use, key sizes, certificate counts, code-signing posture."
> 2. **Cryptographic inventory baseline (10 min):** "Have you completed an NSM-10-style inventory? Most enterprises discover **30%+ more cryptographic assets** than they inventoried."
> 3. **HNDL exposure baseline (10 min):** "What's your highest-sensitivity data — 20-year defense, healthcare, IP? That data is at active HNDL risk today."
> 4. **PQC algorithm coverage (10 min):** "Which NIST PQC algorithms do you need supported — CRYSTALS-Kyber for key exchange, CRYSTALS-Dilithium for signatures, SPHINCS+ for stateless signatures, FALCON for compact signatures?"
> 5. **Crypto-agility posture (8 min):** "Can your application stack swap cryptographic algorithms without code changes? **Crypto-agility middleware** is the modern bar."
> 6. **Certificate management posture (7 min):** "How many TLS certificates are under management? PQC migration touches every certificate."
> 7. **Renewal posture (5 min):** "When is your current PKI or certificate management contract up? What contractual extraction friction would we navigate?"

```mermaid
flowchart TD
    A[AE Schedules 60-Min Discovery] --> B[Send Pre-Brief 24 hrs Prior]
    B --> C{CISO + Cryptographer + Compliance?}
    C -->|No| D[Reschedule No Exceptions]
    C -->|Yes| E[Inventory + HNDL Exposure 20 min]
    E --> F[PQC Coverage + Crypto Agility 18 min]
    F --> G[Cert Mgmt + Renewal 12 min]
    G --> H[Confirm POC Scope Workshop]
    H --> I[Crypto-Agility POC Connected Within 14 Days]
    I --> J[Joint Cryptographer Review at Day 30]
    J --> K[Bind Decision at Day 60]
```

---

## Section 3 — The POC That Wins (15 min)

**Failure modes to ban.** **Algorithm-demo POCs without crypto-agility.** **Single-app POCs.** **No HNDL-exposure assessment.**

**Wins to coach.** **Crypto-agility middleware deployed.** Walk through **DigiCert's and PQShield's published POC agendas** — both deploy crypto-agility middleware that allows swapping algorithms without app rewrites. **HNDL-exposure assessment delivered.** Map customer data classifications to HNDL risk windows. **NIST PQC algorithm interoperability tested.** Run interoperability tests across CRYSTALS-Kyber, CRYSTALS-Dilithium, SPHINCS+, and classical algorithms in hybrid mode.

End with **Andy Paul's** rule: *"Show the customer their HNDL exposure reduced, not your algorithm count expanded."*

---

## Section 4 — Handling the Incumbent Trap (10 min)

The room will face **DigiCert**, **Entrust**, and **Venafi** in eight of ten enterprise deals. Coach the room on three counter-moves.

**Counter-move 1 — The crypto-agility depth wedge.** Ask the Chief Cryptographer: *"Does your incumbent's platform support runtime algorithm swap without app rewrites? **PQShield** and **DigiCert** lead crypto-agility."*

**Counter-move 2 — The hybrid

Post-Quantum Cryptography (PQC) Crypto-Agility Selling to the CISO and Chief Cryptographer — 60-Min Training

Direct Answer

Section 1 — Why Post-Quantum Cryptography Selling Is Different (5 min)

Section 2 — The 60-Minute Discovery Block (15 min)

Section 3 — The POC That Wins (15 min)

Section 4 — Handling the Incumbent Trap (10 min)

Section 5 — Pricing Conversation and Procurement (10 min)

Section 6 — The Trap-Set for Renewal at Month 18 (5 min)

FAQ

Sources

Post-Quantum Cryptography (PQC) Crypto-Agility Selling to the CISO and Chief Cryptographer — 60-Min Training

Direct Answer

Section 1 — Why Post-Quantum Cryptography Selling Is Different (5 min)

Section 2 — The 60-Minute Discovery Block (15 min)

Section 3 — The POC That Wins (15 min)

Section 4 — Handling the Incumbent Trap (10 min)

Section 5 — Pricing Conversation and Procurement (10 min)

Section 6 — The Trap-Set for Renewal at Month 18 (5 min)

FAQ

Sources

What does the score mean?