Introduction

Classical asymmetric cryptography (RSA, ECC, and Diffie-Hellman) - faces an existential threat from quantum computing. Axonius maps cryptographic exposure across your entire asset surface so you can identify vulnerable certificates, identities, and network services before quantum computers make them exploitable.

Audience: Security Architects, CISO & Executive Teams, Identity & PKI Teams, Cloud Security Teams

Difficulty: Advanced

Execution Time: 2–4 weeks (initial inventory), ongoing refinement

Duration of Use Case: Perpetual

Value: Risk Reduction, Regulatory Compliance, Cryptographic Visibility, Migration Planning

What is this use case?

Post-Quantum Cryptography (PQC) Exposure Management identifies every asset in your environment that uses asymmetric cryptographic algorithms - RSA, ECC, or Diffie-Hellman - that a cryptographically relevant quantum computer (CRQC) can break. Because migrating cryptographic infrastructure takes 10–20 years to complete, and because threat actors are already intercepting and storing encrypted traffic today for future decryption (known as "Harvest Now, Decrypt Later"), proactive discovery and prioritization are critical.

Axonius aggregates cryptographic metadata from cloud providers, certificate authorities, identity providers, and network infrastructure through a single agentless query interface, exposing hidden asymmetric technical debt across your environment.

Use Case in Action:

This use case draws from the following adapter integrations:

• AWS (ACM, IAM, CloudFront, Site-to-Site VPN, API Gateway, OpenSearch, RDS, ALB/NLB)
• Venafi
• Sectigo
• DigiCert CertCentral
• Cisco ISE
• Active Directory
• Keyfactor

Why is it Relevant?

• Regulatory pressure: NIST finalized post-quantum standards (FIPS 203, FIPS 204, FIPS 205), and compliance frameworks are establishing deadlines for retiring classical asymmetric algorithms.
• Harvest Now, Decrypt Later: Threat actors capture encrypted traffic today to decrypt when quantum hardware matures. Every day of continued asymmetric exposure grows the volume of at-risk data.
• Long migration timelines: Historical cryptographic migrations—such as SHA-1 to SHA-256 or DES to AES - took 10–20 years. The transition to post-quantum algorithms requires the same lead time, making early discovery essential.

Scope

How do I build this use case?

The starting point for PQC Exposure Management is a set of queries targeting cryptographic metadata fields across certificate, identity, network, and infrastructure asset types.

1. Scoping Queries

   Establish which assets carry asymmetric cryptographic exposure:

   • Certificates using RSA or EC key families
   • Active Directory accounts with legacy Kerberos encryption bitmasks
   • Network services enforcing TLS policies below 1.3
   • Cloud infrastructure bound to customer-managed KMS keys

2. Metric Queries

   Measure exposure severity within your scoped population:

   • Certificate validity period: identify long-expiration assets with extended "Harvest Now, Decrypt Later" exposure windows
   • Kerberos encryption bitmask value: flag DES and RC4 versus AES support
   • Diffie-Hellman group numbers: identify IKEv1 and weak groups in VPN tunnels
   • Signature algorithm: surface compound risk assets (for example, SHA1withRSA)

3. Combine Scoping and Metric Queries

   Target remediation by combining scope and metric signals:

   • Public-facing certificates with RSA or ECC keys and long validity periods
   • Domain Controllers with non-AES Kerberos bitmasks
   • Load balancers using ECDHE-based TLS policies below TLS 1.3
   • VPN tunnels using IKEv1 or weak Diffie-Hellman groups

Adapter Coverage

Visibility

How do I visually explain this use case?

The PQC Exposure Dashboard translates multi-adapter query results into prioritized KPIs, certificate analytics, and identity risk metrics that give security teams a single command center for cryptographic exposure.

Recommended Visualizations

Exposure Overview KPIs — Provide an at-a-glance count of your highest-priority exposure categories, including:

• Vulnerable certificates: active X.509 certificates using quantum-vulnerable asymmetric key families
• Certificates with long expiration: certificates extending past near-term migration windows, increasing Harvest Now, Decrypt Later risk
• AD computer accounts: machine accounts configured with legacy Kerberos encryption bitmasks
• AD domain controllers: identity infrastructure accounts requiring immediate hardening

Certificate Vulnerability Breakdown — Surface the distribution of cryptographic algorithms across your certificate inventory, including:

• Public-key size and key family (RSA vs. EC) to quantify which algorithm families dominate your exposure
• Signature algorithm breakdown to identify compound-risk certificates (for example, SHA1withRSA carries both classical hash weakness and quantum asymmetric vulnerability)
• Vulnerable certificates by issuing authority to prioritize CA relationships for migration coordination

Key insight: Increasing RSA key size (for example, from 2048 to 4096 bits) provides no meaningful quantum resistance. Shor's algorithm breaks both at similar computational cost. Key lengthening is not a mitigation strategy for post-quantum threats — only algorithm replacement is.

Domain and Identity Risk — Show the composition and risk profile of your Active Directory environment, including:

• Computer accounts by role (Workstation, Server, Laptop, Network Device) to scope remediation effort
• OS distribution to surface legacy platforms (Windows 7, Windows Vista, Windows Server 2012, Windows 2000) that lack AES Kerberos support and won't receive PQC patch updates
• Primary Group breakdown to prioritize Domain Controllers, which service enterprise-wide Kerberos authentication and PKINIT smart card handshakes

Actionability

How do I automate this use case?

Reporting

Automatically deliver cryptographic exposure metrics to stakeholders.

Examples:

• Send Email
• Send CSV to S3 or Azure Storage
• Microsoft Teams – Send Message
• Slack – Send Message
• Reports (Send Dashboard)

Ticketing

Automatically create remediation tickets for platform, identity, and cloud teams.

Examples:

• ServiceNow – Create Incident
• Jira Service Management – Create Ticket
• Fresh Service, Zendesk – Create Ticket

Remediation

Run phased hardening actions directly from Axonius query results:

1. Public edge endpoints: Update AWS CloudFront, API Gateway, and ALB/NLB policies to TLS 1.3

2. Active Directory hardening: Set Kerberos bitmasks to enforce AES-128 and AES-256 (bitmask value 24) and disable DES and RC4

3. Certificate lifecycle migration: Configure automated certificate lifecycle management (CLM) integrations between Axonius, Venafi, Sectigo, DigiCert, and AWS ACM. Re-issue certificates using NIST FIPS 204 (ML-DSA) or FIPS 205 (SLH-DSA) signature algorithms as your CA supports quantum-safe root and intermediate authorities.

4. Legacy system isolation: Identify and isolate legacy platforms that can't receive PQC patch sets. Flag them for upgrade or network segmentation.

Algorithm Reference

Reach out to your Sales Engineer or TAM for the latest PQC Exposure Dashboards!