What is the recommended Post-Quantum Cryptography (PQC) Crypto-Agility Vendor sales and operations tech stack in 2027?

What crypto-agility actually sells, and why the buying motion is unusual

Most security categories sell a defense against something happening now. Post-Quantum Cryptography sells a defense against something that has not happened yet and may not happen for a decade — which changes the entire commercial shape of the business. The threat model that carries deals is "harvest now, decrypt later": an adversary captures encrypted traffic today, stores it, and decrypts it when a cryptographically relevant quantum computer arrives. That framing is what turns a hypothetical into a budget line, because any data with a confidentiality lifetime longer than the migration window is already exposed. Health records, mortgage files, sealed legal discovery, defense telemetry, long-dated financial instruments — all of it has a shelf life measured in decades.

The regulatory scaffolding is what converts that argument into a purchase order. NIST finalized the core standards as FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA), giving procurement a citable object instead of a research paper. NSA's Commercial National Security Algorithm Suite 2.0 attached dates: national security systems are expected to move to the approved post-quantum algorithms across a phased window ending around the early 2030s, with software and firmware signing moving first. European bodies published parallel guidance — Germany's BSI through TR-02102, France's ANSSI, the UK's NCSC — each with its own emphasis on hybrid modes and timelines. A vendor's CRM should carry the specific driver as a structured field, because "CNSA 2.0 mandate" and "internal risk committee curiosity" are not the same pipeline.

What the vendor actually sells is rarely a single algorithm. Algorithm implementations commoditize fast — liboqs from the Open Quantum Safe project and PQClean are both open, competent, and free, and every hyperscaler is folding post-quantum key exchange into its own managed services. The durable product is the layer above: an inventory of where cryptography lives, a policy engine that decides which algorithm applies to which use case, an abstraction that lets an application swap primitives without a code change, and a hybrid mode that runs classical and post-quantum in parallel so nothing breaks during the transition. That is crypto-agility, and it is the thing enterprises will still be paying for in 2033 when the current algorithm set has already been amended once.

The buying committee reflects that. A typical deal needs a CISO as executive sponsor, a cryptography lead or newly minted chief cryptography officer for technical validation, a compliance owner mapping the work to whichever regime applies, and — critically — an application-platform owner who will absorb the integration burden. Cycles run six to eighteen months with a proof of concept in the middle, and the proof of concept is almost always a discovery scan rather than an algorithm benchmark. That sequencing matters for how you staff and instrument the funnel: your first technical win is an audit result, not a performance chart.

There is a useful adjacent comparison here. The PQC migration resembles the IPv6 transition and the SHA-1 deprecation more than it resembles buying an EDR agent. Both of those took longer than anyone forecast, both stalled on inventory rather than technology, and both were ultimately dragged forward by browser and platform vendors setting deadlines rather than by enterprise enthusiasm. Expect the same dynamic: certificate authorities and cloud providers will move the market faster than CISO conviction will, and your roadmap should be pinned to their announcements as much as to regulator dates.

The step-by-step process from first scan to steady-state agility

The engagement follows a repeatable arc, and building the stack around that arc — rather than around product features — is what keeps sales, engineering, and customer success pointed at the same milestone.

Stage one is discovery. The customer does not know where their cryptography lives. Nobody does. The scanners have to cover four surfaces: source code, where you look for calls into OpenSSL, Java's JCE, Windows CNG, WebCrypto, and language-native libraries, flagging hardcoded algorithm identifiers and deprecated primitives; network traffic, where passive parsing of TLS handshakes, IKEv2 proposals, and SSH key exchange reveals the negotiated suites actually in use rather than the ones documented; certificates, where you enumerate the internal PKI and public certificate estate by signature algorithm, key size, and expiry; and embedded or operational technology, where crypto is frequently baked into firmware that cannot be patched at all. That last category is where the honest bad news lives — an industrial controller with an RSA key burned into silicon is a hardware replacement project, not a software migration, and surfacing that early builds more trust than hiding it.

Stage two is the roadmap. Inventory becomes a prioritized migration plan sorted by data confidentiality lifetime, regulatory exposure, and cost to change. The useful heuristic is a two-axis sort: how long does this data need to stay secret, and how hard is this system to touch. Long-lived secrets in easy-to-change systems go first because they are pure win. Long-lived secrets in impossible-to-change systems get compensating controls and a hardware refresh line item. Short-lived secrets in hard systems go last and may never move.

Stage three is the agility layer. Applications stop naming algorithms. Instead they request a security property — key establishment, signature, long-term signature — and a policy engine resolves that to a concrete primitive based on jurisdiction, data class, and current standard. In practice this ships as providers rather than as a new API: an OpenSSL provider, a Windows CNG provider, a JCE provider, so existing applications inherit the capability without a rewrite. The policy itself lives in config, version-controlled, auditable.

Stage four is hybrid deployment. Nobody flips from ECDHE to ML-KEM atomically. Hybrid key exchange combines a classical primitive with a post-quantum one so the session is secure if either survives — this is the mode that has actually shipped at scale in browsers and cloud front doors. Hybrid signatures are messier because certificate chains and signature sizes are involved, and ML-DSA signatures are meaningfully larger than ECDSA, which has real consequences for handshake size, embedded flash budgets, and anything doing signature verification in a tight loop.

Stage five is steady state. The standards will change. There will be new algorithms, deprecated parameter sets, and at least one implementation panic. The customer needs continuous re-scanning, drift detection against policy, and a demonstrated ability to swap a primitive in weeks rather than years. This is the renewal argument, and it should be instrumented as a health score in the customer success platform.

The loop at the bottom is the whole business model. A one-way migration is a project; a monitored loop is a subscription.

The commercial layer: CRM, billing, and success tooling for a migration sale

The revenue stack has to accommodate a deal that is part software license, part services engagement, and part multi-year program. That combination breaks naive SaaS tooling in specific ways.

CRM. Salesforce Sales Cloud Enterprise is the default at any meaningful scale, priced per user per month in the mid-hundreds annually depending on edition and contract. What matters more than the platform choice is the object model. You need custom fields for the regulatory driver, the discovery-scan status, the estate size measured in certificates and applications rather than seats, the incumbent cryptographic libraries, and the hardware security module vendor already in place — because a Thales shop and an Entrust shop have different integration paths and different competitive dynamics. Below roughly $20M ARR, HubSpot Enterprise is a defensible choice and considerably cheaper to administer.

Forecasting and conversation intelligence. Clari for pipeline inspection and Gong for call recording are the common pairing, both priced per seat. Gong earns its keep in this category specifically because the technical objections are unusual and repeated — signature size, FIPS validation status, side-channel posture, hybrid interoperability — and the fastest way to level up a new account executive is to let them hear a cryptographer answer those questions twenty times. Outreach or Salesloft handles sequencing, though outbound in this category converts poorly compared to inbound driven by regulatory news cycles and analyst coverage.

Billing. This is where the model strains. Pricing usually blends a subscription component — per developer, per protected server, per deployment, or per certificate under management — with professional services for the migration itself, plus occasional perpetual licensing for embedded and OEM deals where a chip vendor wants to ship your implementation in silicon. Zuora handles that mix and is priced as a six-figure annual commitment at enterprise scale; Salesforce CPQ manages the quote complexity. Below about $50M ARR, Stripe Billing plus a competent revenue-operations person is usually enough and dramatically less operational overhead.

ERP and revenue recognition. NetSuite is the common landing spot, with cost varying widely by module count and user seats. The recognition question is genuinely hard here: a contract that bundles a term license, a discovery engagement, milestone-based migration services, and a support commitment has multiple performance obligations under ASC 606, and getting the allocation wrong is the kind of thing that surfaces during diligence at the worst possible moment. Involve accounting in contract design before the first large deal closes, not after.

Customer success. Gainsight or a lighter alternative tracks health, but the health metrics are unusual: percentage of the inventoried estate migrated, percentage under agility policy, number of algorithm swaps executed successfully, and days until the customer's binding regulatory deadline. Pendo or a similar product-analytics layer covers console adoption. The staffing reality is that customer success managers here need genuine cryptographic literacy — this is a solutions-architect-shaped role wearing a CSM title, and hiring generalist CSMs into it is a reliably expensive mistake.

Compliance and GRC. SOC 2 Type II and ISO 27001 are table stakes and automate cleanly through Vanta or Drata at annual costs in the low five figures for a growing company. The category-specific burden is heavier: FIPS 140-3 validation for the cryptographic module is a twelve-to-eighteen-month process through an accredited laboratory with real cost and real queue time, Common Criteria evaluation matters for European and defense buyers, and FedRAMP authorization is its own multi-year program. Hyperproof or AuditBoard becomes worthwhile once you are managing several frameworks simultaneously. Start the FIPS process earlier than feels comfortable — it is the single longest pole in the tent, and federal deals will simply not close without it.

Engineering infrastructure. Nothing exotic: AWS or Azure as the control plane, Terraform for infrastructure as code, GitHub Enterprise for source, Argo CD or Flux for delivery, Datadog for observability, PagerDuty for on-call. The one distinctive requirement is a hardware test lab. You need physical HSMs from the major vendors, representative embedded targets, and constrained-network simulation, because "it works on my laptop" is not a claim you can make about a cryptographic implementation destined for a smart meter.

Costs, timelines, and what each stage actually spends

Sizing depends far more on validation ambition and federal exposure than on customer count, which is what makes naive SaaS benchmarking misleading in this category.

Seed to early stage, roughly $2M to $15M ARR. The company is usually algorithm expertise plus consulting, with a thin product wrapper. Infrastructure sits on a single cloud with managed Postgres and an analytics store, built on liboqs or PQClean with proprietary hardening layered on top. Commercially: HubSpot Enterprise, Stripe Billing, QuickBooks, a light customer success tool, Vanta for SOC 2. Revenue mix skews heavily toward services — frequently more than half — which is fine at this stage and toxic if it persists. Total tooling and infrastructure spend typically lands in the tens of thousands per month, with headcount dominating everything.

Growth stage, roughly $15M to $60M ARR. Now there is a real platform: discovery at scale, the agility layer, hybrid protocol implementations, HSM and KMS integrations. The commercial stack graduates to Salesforce Enterprise, Clari, Gong, Outreach, Zuora, NetSuite, Gainsight, Pendo, and a multi-framework GRC platform. FIPS validation is in progress and consuming real engineering attention. Monthly spend across tooling, cloud, and validation moves into the high six figures to low seven figures depending on how aggressively the company is pursuing certifications in parallel.

Scale, roughly $60M to $200M ARR. Multi-cloud, multi-HSM, validated modules, CNSA 2.0 alignment, FedRAMP authorized or in process, government cloud regions running in parallel. Salesforce with marketing automation, Zuora at scale, NetSuite OneWorld for multi-entity, a full GRC suite plus ongoing laboratory relationships. Monthly run rate is measured in millions, and a meaningful fraction is compliance rather than compute.

The incumbent path. Hardware security module vendors — Thales, Entrust, Utimaco — and the hyperscalers are extending existing platforms rather than building new ones. For them post-quantum support is a feature within a broader cryptographic infrastructure product, funded as a line item in an existing R&D budget. This is the competitive reality every standalone vendor should plan around: the incumbent does not need to win on post-quantum, only to be adequate at it while winning on everything else.

Timelines that matter. FIPS 140-3 module validation: budget twelve to eighteen months from submission, longer if the laboratory queue is congested. Common Criteria: comparable. FedRAMP: multi-year, and genuinely transformative to your engineering practices. A customer's own migration: five to seven years for a large enterprise, which is why the 2027 planning year matters — the organizations doing discovery now are the ones that will finish before their deadlines. Individual enterprise deal cycles: six to eighteen months, with the discovery pilot typically consuming the first sixty to ninety days.

On pricing structure. Per-seat pricing is a poor fit because the value has nothing to do with headcount. The metrics that correlate with value are certificates under management, applications brought under policy, and protected endpoints. Services should be priced and delivered as distinct milestones — discovery, roadmap, pilot migration, production rollout — so the gross margin story stays legible and the software attach is visible to the board.

Where teams get it wrong

Shipping algorithms instead of a platform. The most common failure. A team with genuine cryptographic talent builds excellent implementations, then loses deals to a cloud provider whose post-quantum key exchange is merely adequate but already enabled by default in a service the customer runs. Algorithm quality is necessary and insufficient. The defensible surface is discovery, policy, and agility — the parts that span an estate the hyperscaler does not see.

Omitting hybrid mode. A vendor that ships pure post-quantum without a classical companion asks customers to bet everything on relatively young mathematics. Security teams will not take that bet, and they are right not to — a lattice cryptanalysis result would be catastrophic in a way that hybrid deployment survives. Hybrid is priority one, not a transitional courtesy.

Underestimating side-channel exposure. Implementations leak through timing, power, and electromagnetic emission. There is published work on side-channel attacks against post-quantum implementations, and the failure mode is brutal: a paper drops, every customer freezes deployment, and remediation happens under a deadline you did not set. Budget for constant-time implementation discipline and recurring third-party evaluation from firms that do this work professionally.

Letting services eat the margin. Migration consulting is enormously valuable and structurally low-margin. If it grows faster than software revenue, the company's valuation multiple quietly converts from software to services. The countermeasures are automation that compresses consulting hours and a systems-integrator channel — the large consultancies want this work and are better positioned to deliver it at scale.

Discovery output that overwhelms rather than informs. A first scan often returns thousands of findings. Handing a CISO an undifferentiated list produces paralysis, not urgency. The output has to be a ranked roadmap with an explicit "here are your fourteen genuinely urgent systems" section. Vendors who make discovery legible convert; vendors who make it exhaustive do not.

Ignoring signature size until integration. ML-DSA signatures and public keys are substantially larger than their elliptic-curve equivalents. That is fine for a web server and painful for a constrained device, a firmware update over a low-bandwidth link, or a certificate chain that suddenly does not fit in a handshake. Test against real constrained targets early. This is where SLH-DSA and Falcon earn their place — different size and speed trade-offs for different deployment realities.

Treating the operations side as an afterthought. Cryptographic engineering teams tend to build brilliant products on top of chaotic revenue operations. The operational discipline is not optional: a six-to-eighteen-month cycle with a technical pilot in the middle needs stage definitions tied to observable customer artifacts — scan complete, roadmap accepted, pilot passed — not to seller optimism.

Choosing your path: build, license, partner, or resell

Four viable postures exist, and the choice cascades into nearly every tooling decision that follows.

Build proprietary implementations. Correct when you have deep cryptographic engineering talent and your differentiation genuinely is implementation quality — constant-time execution, hardware acceleration, tiny embedded footprints, formally verified components. Expensive, slow, and the right answer for anyone selling into defense, silicon, or safety-critical markets. Implies a large validation budget and a hardware test lab.

License hardened implementations. Firms including PQShield sell commercial post-quantum implementations with side-channel protection and validation pathways. This buys years of engineering time and lets a team concentrate on discovery and agility, where product differentiation is more durable anyway. The trade-off is a per-unit or royalty cost structure that compresses margin at volume and a dependency you must diligence carefully.

Wrap open source. liboqs and PQClean are excellent for prototyping, research, and internal tooling. They are not, on their own, a production answer for regulated buyers, because validation status and side-channel hardening are the actual purchasing criteria. Wrapping open source and calling it a product works until the first serious security questionnaire arrives.

Partner and integrate. Build nothing cryptographic; be the discovery, orchestration, and policy layer above whatever the customer's HSM vendor and cloud provider already supply. Fastest to market, lowest technical risk, and increasingly viable as the underlying primitives become universally available. The risk is being squeezed between a hyperscaler that adds inventory features and a consultancy that adds tooling.

A practical note on sequencing: most successful companies in adjacent security categories started at partner-and-integrate, earned the customer relationship through discovery, then moved up the stack once they understood which parts of the migration customers would genuinely pay to automate. Starting with the hardest technical posture and hoping to find the commercial motion later is the more common and more expensive order.

Adjacent markets the same stack unlocks

The infrastructure built for post-quantum migration generalizes further than most teams realize, and the adjacency is worth planning for because it changes what you build first.

Cryptographic inventory is really software supply chain visibility with a cryptographic lens. The same scanners that find deprecated algorithms produce a cryptographic bill of materials, which sits naturally alongside the SBOM work that regulators have been pushing since the 2021 US executive order on cybersecurity. Selling a CBOM to a team that already produces an SBOM is a much shorter conversation than selling a quantum threat model.

Certificate lifecycle management is the nearest commercial neighbor. Enterprises already struggle with certificate expiry, and the shortening of certificate lifetimes pushed by browser and CA/Browser Forum policy has made automation mandatory rather than optional. A discovery product that inventories certificates is two steps from a certificate lifecycle product, and that market has budget today rather than in 2030.

Cryptographic policy enforcement generalizes into broader data protection governance — proving that data classified at a given level is protected by an approved algorithm, everywhere, continuously. That is a control most compliance frameworks assert and few organizations can actually evidence.

There is also a hardware refresh consequence worth naming to customers early. Devices that cannot support the new algorithms — because of memory, compute, or immutable firmware — must be replaced. For manufacturers of industrial equipment, medical devices, automotive components, and payment terminals, post-quantum readiness is becoming a procurement requirement rather than a feature, which makes OEM licensing a real revenue line for vendors with small, efficient implementations.

Finally, adjacent quantum-era technologies — quantum key distribution, quantum random number generation — appear in the same conversations. They solve narrower problems at higher cost and are not substitutes for algorithmic migration. Being clear and honest about that distinction is a credibility asset, because plenty of buyers have been told otherwise.

Related questions

Is quantum key distribution a substitute for PQC?

No. QKD requires specialized optical hardware and dedicated links, does not solve authentication, and scales poorly across the internet. Post-quantum algorithms run on existing infrastructure and address the full protocol surface. Several national security agencies have explicitly discouraged QKD as a general enterprise solution.

What should an enterprise do first in 2027?

Run a cryptographic discovery scan and build an inventory. Nearly every migration stalls on not knowing what exists. Inventory first, then prioritize by data confidentiality lifetime and regulatory deadline. Deploying algorithms before you have an inventory means migrating whatever happened to be visible.

Do we need FIPS validation to sell?

For federal, defense, and most regulated financial buyers, effectively yes — and validation takes twelve to eighteen months. For commercial enterprise buyers, "validation in progress" is often acceptable early. Start the process before you think you need it; the queue is the constraint, not the paperwork.

How large is the signature size problem?

Meaningful. ML-DSA public keys and signatures are considerably larger than ECDSA equivalents, which affects handshake size, certificate chains, firmware update packages, and constrained-device storage. Falcon offers more compact signatures at higher implementation complexity; SLH-DSA trades size and speed for conservative hash-based security.

Should hybrid mode be permanent or transitional?

Transitional in theory, longer-lived in practice. Guidance from European agencies has leaned toward hybrid as the prudent default during the transition period. Build the policy engine so hybrid is a configuration choice rather than a code path, and let customers decide when to drop the classical component.

FAQ

Which NIST algorithm matters most for a vendor to support?

All of the standardized set, with policy-driven selection. ML-KEM handles key encapsulation and is what replaces classical key exchange in TLS and IKEv2. ML-DSA is the general-purpose signature algorithm for certificates and code signing. SLH-DSA is the conservative hash-based alternative — larger and slower, but resting on well-understood assumptions. Falcon offers compact signatures where bandwidth or storage is constrained. A vendor supporting only one has a product gap that a customer's first constrained-device use case will expose immediately.

Can we build the business on liboqs alone?

For prototyping and internal tooling, yes. For a production product sold to regulated buyers, no. Open Quantum Safe's liboqs and PQClean are strong reference implementations, but they do not carry FIPS validation and are not universally hardened against side-channel attack. Serious vendors either build validated implementations themselves or license hardened ones. The open-source libraries remain valuable as interoperability references and as a way to move quickly before committing to a validation path.

How do we price a multi-year migration?

Split it into a subscription component tied to a value metric — certificates under management, applications under policy, protected endpoints — plus milestone-based professional services for discovery, roadmap, pilot, and rollout. Avoid per-seat pricing; the value has no relationship to headcount. Keep the services line visible and separately delivered so gross margin remains legible, and watch the ratio: services outgrowing software persistently is a structural problem, not a phase.

What does the sales team need to know technically?

Enough to be credible on five recurring objections: hybrid versus pure post-quantum, signature size implications, FIPS validation status and timeline, side-channel posture, and interoperability with the customer's existing HSM and PKI. Conversation intelligence tooling earns its cost here by letting new sellers absorb how the cryptographers answer. Every deal will also need a solutions architect who can defend the implementation in front of a hostile internal reviewer.

When does urgency actually arrive?

The planning window is now; execution runs through the early 2030s. CNSA 2.0 sets phased expectations for national security systems, and European guidance points at comparable horizons. Since large enterprise migrations realistically take five to seven years, organizations starting discovery in 2027 are finishing on time and those starting in 2030 are not. Vendor demand should be pinned to that arithmetic rather than to quantum computing announcements.

Will cloud providers commoditize this category?

Partly, and that should shape strategy. AWS, Azure, and Google Cloud are adding post-quantum support to key management and transport services, which will make basic algorithm access free and default. What they will not do well is span a heterogeneous estate — on-premises applications, multiple clouds, embedded devices, third-party SaaS, legacy mainframes. Vendors that anchor on cross-estate discovery, policy, and agility retain a defensible position; vendors that anchor on algorithm access alone do not.

Sources

• https://csrc.nist.gov/projects/post-quantum-cryptography
• https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.203.pdf
• https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.204.pdf
• https://www.nsa.gov/Cybersecurity/Post-Quantum-Cryptography/
• https://openquantumsafe.org/
• https://www.bsi.bund.de/EN/Themen/Unternehmen-und-Organisationen/Informationen-und-Empfehlungen/Quantentechnologien-und-Post-Quanten-Kryptografie/quantentechnologien-und-post-quanten-kryptografie_node.html
• https://www.ncsc.gov.uk/whitepaper/preparing-for-quantum-safe-cryptography
• https://csrc.nist.gov/projects/cryptographic-module-validation-program
• https://www.nccoe.nist.gov/crypto-agility-considerations-migrating-post-quantum-cryptographic-algorithms
• https://datatracker.ietf.org/wg/pquip/about/

Related on PULSE

• [The Immutable Post-Quantum Stack for Blockchain Settlement in 2027](/knowledge/tk0536)
• [What is the recommended API Security Vendor sales and operations tech stack in 2027?](/knowledge/tk0244)
• [What is the recommended Endpoint Detection and Response (EDR) Vendor sales and operations tech stack in 2027?](/knowledge/tk0238)
• [What is the recommended DevSecOps Tooling Vendor sales and operations tech stack in 2027?](/knowledge/tk0243)
• [What is the recommended Data Loss Prevention (DLP) Software Vendor sales and operations tech stack in 2027?](/knowledge/tk0237)
• [What is the recommended Zero Trust Network Access (ZTNA) Vendor sales and operations tech stack in 2027?](/knowledge/tk0231)