October 6 2026

Fractional Quantum-Safe-Migration

admin AI Security Cryptography Leadership, Post-Quantum Cryptography, PQC Talent, Quantum Risk

Your Quantum-Safe Migration Has a Deadline. Does It

Have a Leader?

In June 2026, the White House gave every federal agency 30 days to name a leader for its post-quantum
cryptography (PQC) migration. Who is leading yours?
The same order directs a procurement rule that would hold covered federal contractors to NIST's PQC
standards by the end of 2030, and it directs agencies to help critical infrastructure operators plan. Every
organization now needs an accountable, qualified migration leader, and they are in short supply.

The algorithms are settled. The expertise is not in place.

NIST approved its first three PQC standards in August 2024, and major vendors now ship them. Protocol standards, product support, and validations are still maturing, so deployment depends on experienced people. In the 2026 Entrust and the Ponemon Institute study of more than 4,000 IT and security practitioners, 38 percent cited a lack of in-house expertise as a barrier to post-quantum readiness, up from 28 percent a year earlier. Visibility (41 percent) and budget (39 percent) ranked slightly higher, but expertise rose the most.

The work calls for two complementary capabilities. Program leadership combines cryptography, enterprise architecture, regulatory knowledge, and the standing to brief a board. Cryptographic engineering covers algorithm choices, hybrid designs, performance, and implementation risk. Few organizations have both, so training and experienced guidance need to run together.

Hiring alone will not close the gap

A fractional PQC leader joins your leadership team for set days each month. As an advisor, they recommend the migration strategy and roadmap and brief the board and C-suite. As a fractional executive with delegated authority, they also direct your architects and engineers. The engagement terms set the decision rights, and accountability stays with your named executive.

As well, a fractional post-quantum cryptographer provides the technical depth. They review designs and vendor evidence, recommend algorithms and parameters within applicable standards and policy, and stay engaged through rollout to resolve protocol and integration problems.

The model works because senior judgment is shared across several programs while each clients permanent team carries out the sustained work. You can engage one or both roles, under clear confidentiality and conflict-of-interest terms.

The fractional model

The model works because senior judgment is shared across several programs while each client’s permanent team carries out the sustained work. You can engage one or both roles, under clear confidentiality and conflict-of-interest terms.

When it fits, and what you receive

Fractional engagement fits when a named executive is accountable, an internal team can execute, and the gap is senior judgment, not headcount. Where a program needs embedded staff or has no team to execute, it complements a hire or an integrator.

The engagement produces defined deliverables: a cryptographic inventory plan and risk-ranked roadmap, architecture decisions and supplier requirements, pilot and acceptance criteria, and board reporting on progress and risk.

What it delivers

Speed. Leadership is in place quickly not after a search that can take months.
Matched commitment. The fractional leader and/or fractional cryptographer time is engaged in proportion to the workload.
Lower program risk. Early decisions on inventory, priorities, and vendors shape much of what follows, and experience at the start can reduce avoidable rework.
Stronger internal teams. A good fractional leader develops your people, so reliance on outside help can fall over time.

The model suits both large enterprises that lack this specialty and smaller companies that cannot outbid them for it.

Where consulting firms fit

Consulting firms and integrators will staff many of these programs, and they can provide senior specialists too. However, ask any provider the same questions. Who is the named specialist, and will they stay? What relevant experience do they bring? How much of their time is committed, and what will they deliver?

Independence is not automatic. It rests on disclosed relationships and written engagement terms.

The question for your next leadership meeting

Who is accountable for our cryptographic migration, and what evidence shows they can deliver it? Look for relevant cryptographic transition experience, hands-on PQC implementation work, and a record of delivery. If the answer is unclear, the program is already at risk.

We place fractional PQC leadership and cryptographic advisory expertise. Our search specialty is PQC migration, quantum resilience and AI infrastructure leaders and experts, for fractional as well as permanent roles. Please reach out to us at info@hermancollins.com. We would welcome a conversation.

Sources

Executive Order 14412, Securing the Nation Against Advanced Cryptographic Attacks, White House, June 22, 2026: the 30-day migration lead requirement, the contractor rule, and critical infrastructure assistance.
NIST, Announcing Approval of Three Federal Information Processing Standards (FIPS) for Post-Quantum Cryptography, August 13, 2024: approval of FIPS 203, 204, and 205.
Entrust and Ponemon Institute, 2026 Global State of Post-Quantum and Cryptographic Security Trends, news release of January 27, 2026: 4,149 IT and security practitioners surveyed, with the expertise, visibility, and budget figures.

Contact Herman Collins LLC

Schedule a briefing

July 8 2026

The Agentic AI/Quantum Talent Collision

admin AI Security Cryptography Leadership, Post-Quantum Cryptography, PQC Talent, Quantum Risk

The Agentic AI/Quantum Talent Collision

AI Agents are expanding your cryptographic risk faster than the market can

produce talent to secure it.

Contact Herman Collins LLC

Two curves are converging in both enterprise and government security, and most leaders are standing directly at the intersection.

The first curve is agentic AI adoption. Enterprises and agencies are deploying autonomous agents across their most critical operations at a pace no security, identity, or architecture team can realistically absorb. Every one of those agents authenticates, signs, and encrypts, and many rely on RSA, ECDSA, ECDH, and classical PKI components that federal migration policy now targets for replacement or augmentation.

The second curve is flat. The pool of people who understand cryptography, PKI modernization, machine identity, and AI-risk governance at once is one of the smallest in technology, and it is not growing at anything close to the rate of demand. McKinsey research has found only one qualified quantum candidate for every three open quantum roles, and MIT’s Quantum Index Report 2025 shows US job postings requiring quantum skills tripled from 2011 to mid-2024.

The cited quantum workforce data does not measure PQC migration specialists directly; it is a proxy for the broader shortage of people who can operate across quantum risk, cryptography, identity architecture, and enterprise governance. The actual intersection required for agentic-AI security is narrower still. Federal policy now reflects the same concern: recent White House directives on post-quantum cryptography order the Office of Personnel Management to build a strategy for recruiting quantum expertise into government service. When one of the world’s largest public-sector employers starts a formal recruiting campaign for a skill set, it is telling you what the market for that skill set looks like.

One curve is rising exponentially. The other is not moving. The organizations caught between them are accumulating a specifi kind of debt, and that debt now has a due date.

Agentic AI Does Not Just Use Cryptography. It Creates It.

AI agents are already embedded across critical operations:

Financial services: risk scoring, fraud triage, loan processing
Healthcare: care coordination, patient engagement, clinical workflow routing
IT operations: cloud optimization, incident response, deployment analytics
Retail and e-commerce: supply chain logistics, demand forecasting, personalization
Government: benefits processing, regulatory monitoring, supply chain protection

Agentic AI is no longer an experiment. It is infrastructure. And every agent-to-agent interaction can create or depend on session keys, tokens, certificates, secrets, and trust relationships. Every deployment expands the quantum-vulnerable surface your organization will eventually have to inventory, prioritize, and migrate.

Organizations scaling agents today are, in effect, taking on cryptographic debt. Unlike most technical debt, this debt is acquiring repayment dates: mandated for federal agencies and their contractors, and increasingly assumed by customers, auditors, and markets everywhere else.

Where the Exposure Lives

Agentic systems concentrate their cryptographic risk in a few places:

RSA- and ECDSA-signed identity tokens (JWTs) used for agent identity and workflow routing

Classical TLS and mTLS certificates securing agent-to-agent and agent-to-service communication

Legacy PKI anchoring trust boundaries across multi-agent workflows

OAuth/OIDC token flows handling authorization and identity federation across agent and service boundaries

Workload identity systems (SPIFFE/SPIRE) issuing and rotating machine identities for agents and the services they call

Service mesh mTLS encrypting east-west traffic between agents, microservices, and data planes

API gateways and MCP/tool-calling gateways the choke points where agents authenticate to tools, models, and external services

Secrets managers and KMS/HSM integrations storing, wrapping, and distributing the keys every other layer depends on

Code-signing and container-signing chains providing provenance guarantees for agent binaries, models, and images

Vector database and API connector authentication guarding the data stores and endpoints which agents query

Agent orchestration frameworks and plug-in ecosystems importing inherited cryptographic dependencies from third-party components

Embedded cryptographic libraries buried inside agent frameworks and vendor products, often invisible to the teams deploying them

The issue is not that every cryptographic primitive fails equally. Symmetric encryption and hash-based mechanisms remain part of the future-state architecture when sized and implemented appropriately. The urgent exposure is concentrated in public-key cryptography: RSA, ECDSA, ECDH, certificate chains, token-signing keys, and PKI trust anchors that depend on integer factorization or discrete logarithm hardness.

These public-key dependencies do not survive a cryptanalytically relevant quantum computer (CRQC) without migration or compensating design. And the risk is not waiting for one to arrive: adversaries are harvesting encrypted traffic today to decrypt later (Harvest Now, Decrypt Later). Agent traffic is a prime target, because agents routinely touch an organization’s most sensitive datasets. The operational consequences compound: eroding PKI becomes a long-term liability, quantum-vulnerable tokens become identity bypass vectors, and cryptographic failures cascade across multi-agent workflows in ways single-application failures never did.

This is not a tooling problem. It is an architecture and governance problem, and architecture and governance problems are solved by people.

The Debt Has a Due Date

The regulatory environment has stopped asking whether organizations will migrate to post-quantum cryptography and started specifying when:

Under Executive Order 14412 (June 2026), federal agencies must migrate high-value assets to PQC for key establishment by December 31, 2030, and for digital signatures by December 31, 2031.
EO 14412 directs the FAR Council to publish a proposed Federal Acquisition Regulation rule requiring covered contractors to comply with NIST’s PQC standards by the end of 2030. If you sell to the government, the government’s deadlines are becoming your deadlines.
Draft language in the FY27 National Defense Authorization Act would put the Department of Defense on an even faster migration schedule, with ripple effects across the defense industrial base.
CISA and NIST are developing formal guidance on the Cryptographic Bill of Materials (CBOM), the inventory that every migration deadline quietly depends on. “We don’t have an inventory” is about to stop being an acceptable answer.
NIST’s FIPS 140-2 certificates move to historical status in September 2026, tightening the module validation pipeline just as PQC demand surges.

These obligations do not fall uniformly, and it is worth being precise about who faces what. Federal agencies face direct, dated mandates. Federal contractors face requirements arriving through the FAR rulemaking and contract flow-down clauses. Commercial enterprises face no direct federal deadline today, but three pressures reach them anyway: NIST guidance targets deprecation of quantum-vulnerable algorithms by 2030 and disallowance by 2035, harvest-now-decrypt-later exposure accrues regardless of any regulatory date, and federal security requirements have historically amplified into commercial expectations through supply chains, insurers, auditors, and sector regulators. The deadline structure differs by sector; the direction does not. And every tier arrives at the same constraint: the deadlines land precisely as agentic AI is multiplying the surface that must be modernized.

The Five Actions That Matter, and Who Must Own Them

If your organization is deploying agentic AI, or buying it from vendors, these are the actions that determine whether you meet the coming requirements. Each one has a name attached to it, or it does not happen.

CBOM inclusion. Every AI agent, agent runtime, and agent-to-service workflow should be brought into CBOM scope wherever it uses or depends on cryptography, including cryptographic libraries, protocols, token-signing mechanisms, certificates, keys, trust anchors, and service identities. Owner: a CBOM program lead with both cryptographic and asset-management fluency.
Algorithm modernization. Prioritize replacement of RSA, ECDSA, and the classical PKI elements that anchor agent identity, moving to NIST-standardized PQC algorithms on a schedule aligned with the 2030 and 2031 deadlines. Owner: a cryptographic architect who can sequence migration without breaking production identity.
Vendor compliance. Require that agentic AI vendors support NIST-approved PQC algorithms and publish cryptographic roadmaps. The FAR rulemaking directed by EO 14412 is set to make this a contract-eligibility question, not a preference. Owner: a security-literate procurement or third-party risk leader.
Zero-trust boundaries. Agents must authenticate continuously, operate with least privilege, and stay isolated from sensitive trust boundaries. Zero trust is the architecture that makes PQC migration survivable while it is in progress. Owner: an identity and access architect who understands machine and agent identity, not just human identity.
Leadership and governance. Someone at the executive level must own quantum risk and agentic AI security as a program, with board visibility and budget authority. In most organizations today, that role does not exist.

A Note for Boards

Directors do not need to understand token signing algorithms. They need to ask three questions. First: do our regulatory and contractual obligations now include PQC deadlines, directly or through our federal customers? For a growing share of organizations, the answer is yes. Second: are our AI initiatives expanding a risk surface we have not inventoried? Third: who in this organization owns quantum risk, by name? If the answer to the third question is “no one,” you are not alone: ISACA’s 2025 Quantum Computing Pulse Poll of more than 2,600 digital trust professionals found that while 62 percent worry quantum computing will break today’s encryption, only 5 percent of organizations have a defined quantum strategy, and only 7 percent of professionals claim a strong understanding of the NIST PQC standards. Being in the majority does not make it less of a governance gap with fiduciary implications, and it is the board’s job to see it closed.

The Market You Are Competing In

Every action above assumes access to people at the intersection of cryptography, PKI modernization, machine identity, and AI-risk governance. That intersection was thin before the deadlines existed. Now the federal government is formally recruiting from it, defense contractors are staffing against accelerated NDAA timelines, and every major vendor is hiring the same profiles to build the products everyone else will buy.

Without the right people, PQC programs stall, agentic systems stay vulnerable, and quantum-exposed architectures persist past deadlines that are no longer negotiable. The organizations that meet the 2030 and 2031 dates will be the ones that secured their leadership and architecture talent early, while it was still available.

This is the work we do. Herman Collins LLC identifies and places the cryptographic architects, PKI modernization leaders, and AI-risk executives who can actually deliver PQC migration, quantum-safe identity, interconnect and agentic AI security at enterprise scale.

C-Suite AI Defense Checklist

Confirm AI agents, agent runtimes, and agent-to-service workflows are in CBOM scope
Review quantum-vulnerable cryptographic components, starting with agent identity
Prioritize modernization of RSA, ECDSA, and classical PKI dependencies
Require vendor compliance with NIST PQC standards and published roadmaps
Enforce zero-trust boundaries around agentic workflows
Establish continuous cryptographic monitoring
Name an executive owner for PQC and AI-risk governance, and report on the search until the seat is filled

Start With the Leadership Gap

The deadlines are set. The inventory requirements are coming. The talent pool is not getting larger. The one variable still under your control is how quickly you put the right people in the right seats.

Request a PQC Leadership Gap Assessment. We specialize in retained recruitment for Quantum Resilience and AI Security. In one briefing, we will map the roles your PQC and agentic AI security program requires, benchmark them against your current organization, and show you strategies to fill any gaps.

Contact Herman Collins LLC

Schedule a briefing