Well, Halloween is over, but that doesn’t mean the shambling undead have all crawled back into their graves quite yet. If you’re reading this, there’s a good chance that you have some responsibility for the assets on your network, and that includes one of the most unhallowed categories, sure to spook CISOs when they swap stories of breach incidents: those dreaded End-of-Life (EOL) / End-of-Service (EOS) devices and operating systems that haunt the shadows of your network infrastructure.
But never fear! CISOs who have spent years wringing their hands and scraping together budgets to address their EOL detritus now have a powerful new weapon in their undead-fighting arsenal: Post-Quantum Cryptography (PQC) migration mandates.
PQC: What is it, and what can we do? #
So, what is PQC all about, anyway? Here’s the extremely short version: Public key cryptography powers almost all of the secret-keeping we rely on today. Key exchange, which is what makes HTTPS, TLS, secure messaging, and online financial transactions work, is mostly handled cleanly in modern technology stacks, and things are getting better every day. We know how to swap out key-exchange algorithms when needed, and, as long as we upgrade, we’re pretty much in the clear there today.
What’s almost entirely unsolved, however, is attestation: guaranteeing that a given software package or firmware update is untampered with and genuinely issued by the vendor. When quantum algorithms break traditional digital signatures, validating authentic software updates becomes kind of impossible. This isn't just another tech hype cycle: it’s a fundamental architectural shift, and it demands real work right now. We saw this on a small scale with the eMudhra CA whoopsie back in mid-October 2026: trivially easy-to-crack private keys put several thousands of software build pipelines at risk. Now, imagine that, but for every traditional certificate.
I expect we’ll get this sorted out in the next year or two (and I really think the eMudhra event was super helpful in reminding us that this stuff is hard), but even if we do, it doesn’t matter much when you’re being dogged by those cursed EOL devices!
Left Behind: EOL systems can't be saved #
Those left behind in this migration, of course, will be all those legacy EOL systems. By definition, EOL equipment and software can no longer be updated or patched by vendors to deal with the coming threat of a Cryptanalytically Relevant Quantum Computer (CRQC).
And it’s not just the dusty old Windows 7 desktop in the corner running that one ancient critical-to-you application. The entire operational technology (OT) and industrial control system (ICS) space is notoriously slow and expensive to update. Many embedded OT devices are designed for service lifespans of 15 to 20 years, or more, putting them squarely in the crosshairs of the quantum transition window. Planning for PQC now, with an eye toward EOL management later, can help you figure out how to switch over before it’s too late.
What if Q-Day never comes? #
One of the big psychological barriers with PQC adoption is that nobody knows the exact deadline, or if it will happen at all. Q-Day (the point at which CRQCs become operational for cyber adversaries) is shrouded in the unknowable mists of the future, and there’s a well-educated minority of crypto-critics who believe that CRQCs are fundamentally incompatible with the physical universe. This uncertainty leads to executive inertia because preparing for an unknown, and possibly unreal, due date feels speculative.
In reality, we’re looking at a Y2K-level effort (or a Year 2038 problem, if you prefer) to prepare, but without the convenience of a hard calendar timestamp. To complicate matters more, when Q-Day arrives, things won't instantly burst into flames. Systems will appear to operate normally, right up until every legacy signed binary and certificate is retroactively rendered untrustworthy.
Putting all that speculation aside, though, you can still make concrete progress on PQC goals right now simply by identifying and decommissioning your EOL infrastructure. After all, if Q-Day never does come, recall the immortal words of cartoonist Joel Pett: “What if it's a big hoax and we create a better world for nothing?” Or, consider the advice of Rahm Emmanuel, and don’t let this PQC crisis go to waste.
Grab a shovel #
So, if your executive team, board, shareholders, or customers are pushing for PQC readiness (perhaps pointing to Executive Order 14412, issued by the White House in June of 2026), here’s One Cool Trick: you can leverage PQC mandates to finally secure budget and backing to banish your EOL tech debt, right now. To hit any real PQC objective, you must start with a comprehensive, automated, and active asset management foundation.
Of course, that’s where the runZero platform comes in. runZero offers specialized EOL-detection intelligence that pinpoints EOL/EOS status across operating systems and network devices, without needing local agents or administrative credentials – precisely the kinds of devices that you need to find, right now, and figure out what to do with. For much more, see my paper from last year, Undead by Design, and check out runzero.com/try to kick off your free trial today!
