How Axonius extends PQC readiness across AWS and every other environment

Post-quantum cryptography (PQC) refers to algorithms designed to withstand attacks from quantum computers. Traditionally, enterprise systems have relied on asymmetric algorithms like RSA, ECDH, or ECDSA to ensure confidentiality and integrity of data. A sufficiently capable cryptographically relevant quantum computer could weaken the confidentiality or authenticity protections that depend on these traditional algorithms. 

Although a cryptographically relevant quantum computer is not currently available,  organizations may be accruing risks today from ‘harvest-now-decrypt-later,’ whereby a threat actor collects encrypted data in transit today for possible future decryption. Organizations may also want to plan ahead for post-quantum roots of trust, for example when signed software will be consumed by remote devices that will remain in service for long periods of time. 

In August 2024, the National Institute of Standards and Technology (NIST) finalized three Federal Information Processing Standards (FIPS) for post-quantum cryptography:

• FIPS 203 (ML-KEM, for key encapsulation), 

• FIPS 204 (ML-DSA, for digital signatures), and 

• FIPS 205 (SLH-DSA for stateless hash-based digital signatures). 

Governments and standards bodies are now publishing PQC migration timelines, many targeting the early 2030s. The AWS CISO’s guide to post-quantum mandates and migrations summarizes them.

Organizations should begin planning their post-quantum cryptographic journey today, starting with identifying their highest risk workloads. The next step is understanding dependencies for these workloads, where vendors or software providers will take responsibility for upgrading the services you consume. For custom infrastructure that you have built and are responsible for, starting inventory now gives you time to systematically plan remediation which may include replacing hardware, modernizing software, or both. Starting analysis and planning early gives organizations more time to thoughtfully plan and execute migration work with an eye towards long-term sustainable governance and crypto-agility.

How AWS is simplifying PQC transition in the cloud

AWS has contributed to post-quantum cryptographic R&D, standardization, and delivery for more than a decade. AWS’s open-source cryptographic library, AWS-LC, is FIPS 140-3 validated and was the first open-source cryptographic module to include ML-KEM in its FIPS validation. For workloads built on AWS managed services, AWS has published  migration guidance based on a shared responsibility model. Under this model, AWS is migrating the services it operates to PQC (see the AWS migration plan), and customers are responsible for updating their clients, SDKs, and resource configurations to use the PQC capabilities AWS provides  The present focus is on upgrading encryption of data in transit (PQ confidentiality) as aligned with globally recommended priorities. The updates customers make today also prepare them for later steps, such as post-quantum certificates and authentication, as described in the AWS migration plan.

Built-in cryptographic agility is the new normal for data protection overall. 

Several AWS services already support PQC. AWS Key Management Service (AWS KMS), AWS Certificate Manager (ACM), and AWS Secrets Manager endpoints support hybrid post-quantum key agreement using ML-KEM, as do Amazon CloudFront and Amazon S3. AWS KMS and AWS Private Certificate Authority (AWS Private CA) support ML-DSA signatures for quantum-resistant roots of trust. For resources customers own, such as load balancers, customers can select TLS policies that support ML-KEM. See Post-Quantum Cryptography at AWS for current capabilities.

To help security leaders drive the most long-term benefit from post-quantum cryptographic migration investments, AWS offers complementary education on modern data protection best practices (read the blog, or request a learning workshop).

Extending PQC readiness to custom and on-premises infrastructure

Quantum-related cryptographic risk can affect dependencies across cloud, on-premises, operational technology, and software environments. Organizations need to understand their cryptographic dependencies across AWS-native, lift-and-shift, and on-premises workload components.

Organizations may encounter at-risk cryptographic primitives at many points in their technology stacks:

• Authentication & Identity: mTLS, SSH auth, SSO protocols (OIDC, SAML, OAuth), and proof of possession.

• Network & Data Protection: In-transit privacy via VPNs, site-to-site cloud tunnels, and HTTPS, alongside database encryption at rest.

• Infrastructure & Server PKI: Self-signed certificates or self-managed PKI identifying  servers, services, and endpoints: many using RSA-2048 or EC keys that NIST IR 8547 (draft) proposes deprecating after 2030. 

• Access & Automation Keys: SSH host and user keys spread across servers, jump boxes, and automation accounts, often provisioned without central tracking.

• Software Integrity & Runtimes: Code signing certificates, and signature verification infrastructure, securing build pipelines, plus embedded application libraries and older container images that lack visibility and governance

• Client and operating system platforms: Server-side upgrades are only half the story. Modern algorithms must be enabled and preferred, with telemetry to eventually disable obsolete algorithms, within operating systems, containers, CI/CD automation, third party software installed within enterprises, and more. 

The technology stack spans multicloud, on-premises, operational technology (OT), remote IT, and software as a service (SaaS) environments. Migration planning  should account for  cryptographic dependencies both within and outside AWS workloads. Many organizations are treating migration and modernization as a key strategy to become PQ-ready today and remain PQ-ready over time. Visibility, telemetry, and governance are key pillars to help security leaders and teams address the broader and deeper aspects of data protection in the post-quantum era. 

The AWS + Axonius partnership for PQC

Axonius and AWS and recently announced a Strategic Collaboration Agreement. Axonius helps customers gain visibility into cryptographic dependencies and current cryptographic posture across AWS and non-AWS environments. Further, Axonius helps customers quickly prioritize the most urgent issues, with contextual help to drive remediation.

For PQC specifically, Axonius can:

• Discover certificate algorithm, key size, expiry, and exposure data, including for AWS resources through the Axonius AWS adapter

• Map encryption types for Active Directory and Kerberos service accounts that may rely on quantum-vulnerable authentication

• Passively analyze network key exchange to flag connections negotiating quantum-vulnerable algorithms

• Surface unmanaged and self-signed certificates, helping customers identify candidates to move to AWS Certificate Manager (ACM)-managed certificate lifecycle, including ACM exportable public certificates for use outside AWS

Axonius pulls asset data from across the full environment (cloud and on-premises, managed and unmanaged, AWS and non-AWS) and reconciles it into a single continuously updated model. The Adapter Network connects over 1,400 data sources: certificate management platforms, endpoint management tools, PKI systems, vulnerability scanners, identity providers, network infrastructure, OT, and IoT. Recognition of the value of Axonius’ Asset Intelligence approach comes from Forrester, who named Axionius a Strong Performer in The Forrester Wave™: Proactive Security Platforms, Q3 2026. 

Speed matters here. Brian Wendland at GLG put it this way: "The Axonius AWS workspace connector pulled all that information in a couple of minutes. Before Axonius, that wasn't possible." Applied across the full estate, that speed is what makes continuous reconciliation practical instead of periodic.

Western Union’s engineering operations team uses 38 Axonius adapters, including the AWS adapter, to validate security coverage across AWS and non-AWS environments. The team raised security agent coverage to 99% of assets, including ephemeral cloud instances, and cut manual workload by 50%.

Post-quantum migration is not a one-time audit. New certificates get issued, new workloads go live, new container images get built with outdated libraries. A snapshot inventory is stale as soon as it's taken. Cryptographic requirements are expected to keep evolving, from hybrid key exchange for confidentiality toward post-quantum certificates for authentication and, eventually, pure post-quantum key exchange. Axonius maintains a continuously reconciled view of the cryptographic asset estate, surfaces changes as they occur, and gives practitioners the enforcement layer to tag, notify, and route assets that fall outside expected configurations.

Get PQC ready with Axonius and AWS

AWS provides PQC support and migration guidance; customers remain responsible for assessing and configuring their workloads. Use the AWS migration guidance to plan PQC upgrades for your AWS workloads. The Axonius team has the steps and technology to extend the program for all the other planes and make it continuous. To learn more, connect with one of our specialists.

The content and opinions in this blog are those of the third-party author and AWS is not responsible for the content or accuracy of this blog.