RESOURCE
Every post-quantum roadmap, from the Cyber Centre's to the G7's, starts with the same instruction: inventory your cryptography. Here is what that means in practice and why it is the first phase of every Fabric engagement.
Fabric Networks
Start with a conversation about your cryptographic posture.
Ask a network operator how many VPN tunnels they run and most will give you a number. Ask which key exchange each tunnel negotiates, which certificates sit behind the SCADA historian, which cipher the backup appliance uses at 2 a.m., and the number becomes a shrug. That shrug is the problem the quantum era exposes. You can't fix what you can't see.
The Canadian Centre for Cyber Security's migration roadmap for the Government of Canada (ITSM.40.001) asked departments to have an initial migration plan in place by April 2026, with high priority systems migrated by the end of 2031 and everything else by the end of 2035. Its plain language guidance for organizations (ITSAP.00.017) says the first move is a cryptographic inventory. The G7 Cybersecurity Working Group's September 2026 call to action, which Canada co-signed, repeats it: identify critical assets, map cryptographic dependencies, then plan. Nobody serious puts a product first. They put visibility first.
A useful inventory answers four questions for every encrypted flow and every stored secret. What algorithm and key length is in use? Where does the key come from and who can rotate it? What data does it protect and for how long does that data need to stay confidential? And what is the lifecycle of the equipment on each end, because a controller installed this year will still be running when a cryptographically relevant quantum computer may exist. The last question is the one most spreadsheet inventories miss, and it is the one that decides your priority order.
Our Discovery Program runs over three months and starts with virtual probes placed on your network, not agents installed on your systems. Encryption Intelligence observes what is actually negotiated on the wire and what is actually stored, across IT, OT and cloud, without touching production. The result is a cryptographic bill of materials: every certificate, key, protocol and cipher, tied to the asset, the data and the equipment lifecycle. That document is the foundation for Phase 2, and it is also the artifact a regulator, an auditor or a board will ask to see first.
If you have not started, pick one site and one business process, and inventory only that. A single pipeline control network or a single treasury system is enough to learn how the exercise runs and what it turns up. Then take the harvest now, decrypt later question to your executive team: what data crossing our network today would still hurt us if it were read in 2032? Their answer sets the scope of the full program.