As federal agencies accelerate their transition toward post-quantum cryptography (PQC), the conversation often focuses on new algorithms, cryptographic standards, and future threats. But before any modernization effort can begin, agencies face a more fundamental challenge: Do you know where your cryptography actually exists today?
That question sits at the heart of recent federal guidance, including National Security Memorandum 10 (NSM-10) and OMB Memorandum M-23-02, both of which emphasize a straightforward but critical sequence:
- Discovery
- Inventory
- Roadmap Development
Before organizations can begin replacing vulnerable cryptographic implementations, they must first develop comprehensive visibility into the cryptographic technologies already operating across their networks, systems, and applications. This was the central theme of a recent technical session featuring Tychon, a company focused on cryptographic discovery and inventory at enterprise scale.
The Cryptography Iceberg Problem
One of the most compelling concepts discussed during the session was what can be described as the “cryptography iceberg.” Most organizations believe they have a reasonable understanding of their cryptographic environment. In reality, they are often only seeing a fraction of it. The visible portion typically includes:
- Known certificates
- Managed applications
- Standard TLS deployments
- Documented infrastructure
Beneath the surface lies a much larger challenge:
- Legacy systems
- Operational technology (OT) environments
- Embedded devices
- Hybrid cloud deployments
- Tactical systems
- Mission-critical applications developed years or decades ago
This hidden portion often represents the majority of cryptographic risk within an organization. Without visibility into these environments, agencies cannot accurately assess exposure, prioritize remediation efforts, or build a realistic PQC migration strategy.
Why Discovery Is the First Step Toward Quantum Resilience
Federal agencies are under increasing pressure to prepare for future quantum threats. However, current government guidance has been remarkably consistent: The immediate priority is visibility, not remediation. Before discussing migration timelines, algorithm replacement, or application redesign, agencies must understand:
- Which cryptographic algorithms are being used
- Where certificates reside
- Which protocols support encryption
- How key exchanges occur
- Which assets represent the highest mission risk
This information forms the foundation for every subsequent modernization effort. Agencies that skip this step risk creating migration plans based on incomplete or inaccurate information.
How Tychon Approaches Cryptographic Discovery
Tychon addresses this challenge through a large-scale cryptographic discovery and inventory platform designed for federal environments. The platform focuses on endpoint-level visibility across enterprise networks while avoiding one of the biggest deployment hurdles in government environments: agents. Instead of requiring new software on every system, Tychon leverages existing infrastructure to collect information about:
- Applications
- Protocols
- Certificates
- Key exchange algorithms
- Cipher suites
- Cryptographic implementations
The resulting data can then be analyzed against NIST guidance and integrated into platforms such as Splunk and Elastic for additional processing and reporting.
Beyond Dashboards: Turning Visibility into Action
Discovery data only becomes valuable when it leads to action. A key differentiator highlighted during the session was Tychon’s emphasis on actionable outputs rather than simply presenting dashboards. Examples include:
- TLS upgrade recommendations
- Weak cipher identification
- Post-quantum readiness assessments
- Modernization planning insights
- Cost estimates for cryptographic upgrades
The objective is not merely to identify problems but to provide organizations with a practical path toward remediation and modernization.
Strengths in the Federal Environment
Several factors make cryptographic discovery platforms increasingly attractive to government organizations.
- Massive Operational Scale: Tychon reportedly supports approximately 800,000 endpoints across Army environments, demonstrating an ability to operate within large and complex federal ecosystems.
- Agentless Deployment: Government organizations often face significant challenges when introducing new endpoint software. An agentless approach reduces deployment friction and simplifies adoption.
- EMASS and Reporting Integration: Many agencies continue to struggle with cryptographic inventory reporting requirements. Integration with EMASS and support for OMB reporting processes can significantly reduce the manual effort required to maintain compliance documentation.
- Military-Centric Design: The platform’s development by former military cyber operators helps align the solution with federal operational realities and mission requirements.
The Remaining Challenges
While cryptographic discovery is essential, it is not a complete solution by itself.
Visibility Is Not Asset Intelligence
Discovery tools can identify cryptographic implementations, but they still rely on accurate asset management systems for context. Organizations need supporting data from:
- CMDB platforms
- ServiceNow environments
- EMASS
- High Value Asset (HVA) inventories
- Mission ownership records
Without this context, visibility alone cannot fully prioritize modernization efforts.
The Software Factory Gap
Many agencies increasingly want answers to deeper questions:
- What cryptography exists in source code?
- Which applications require refactoring?
- How can developers build crypto-agile systems?
Runtime discovery identifies what is currently operating, but it does not provide complete visibility into application codebases. This remains a critical area for modernization planning.
Ephemeral Infrastructure Remains Difficult
Modern environments continue to evolve toward containers, Kubernetes, and dynamic workloads. These systems can:
- Spin up quickly
- Execute workloads
- Terminate before inventory systems capture their activity
As a result, cryptographic discovery within highly dynamic environments remains an ongoing challenge across the industry.
Building a Complete PQC Readiness Strategy
The transition to post-quantum cryptography will require more than a single tool. Organizations that successfully navigate this shift will likely combine:
- Cryptographic discovery platforms
- Software composition and code analysis tools
- Crypto-agility solutions
- Network-layer protections
- Asset inventory systems
- Governance and reporting capabilities
Most importantly, they will establish phased migration roadmaps aligned to mission priorities and high-value assets.
The BLUF
Quantum readiness begins with visibility.
Federal agencies cannot modernize cryptography they cannot see, and current government mandates make discovery and inventory foundational requirements for every organization.
Tools like Tychon play a critical role by helping agencies identify cryptographic assets, assess risk, and begin planning for a post-quantum future. However, discovery is only the starting point. Real success comes from integrating visibility data with asset intelligence, application modernization efforts, and crypto-agile architectures. The organizations that move fastest toward quantum resilience will be the ones that start now, build accurate inventories, and create realistic, phased migration strategies before today’s cryptographic protections become tomorrow’s vulnerabilities.
Synopsis
This episode of The Bottom Line Up Front focuses on post-quantum cryptography readiness by first achieving comprehensive visibility into existing cryptography. Drawing from a technical session with TYCHON, explaining how NSM-10 and OMB M-23-02 emphasize a sequence of discovery, inventory, and roadmap, with DoD prioritizing planning over immediate remediation. Tychon is presented as an agentless, endpoint-level cryptographic discovery and inventory platform that collects data on protocols, algorithms, certificates, and more, scores risk against NIST standards, integrates with tools like Splunk/Elastic and eMASS, and outputs recommendations such as TLS upgrades, weak cipher identification, PQC readiness, and cost estimates. We notes gaps including limited asset context without CMDB/tagging, lack of code-level analysis, and challenges with ephemeral containerized infrastructure, and concludes that agencies need integrators like ATPGov to turn discovery into phased modernization roadmaps.
- 00:00 Why Crypto Visibility?
- 01:11 Mandates Driving Action
- 01:48 What Tycon Does
- 02:37 Iceberg Risk Reality
- 03:27 Strengths In DoD Scale
- 04:00 Gaps And Blind Spots
- 04:48 Bottom Line Takeaways
- 05:16 Building Full PQC Stack
- 06:08 Call To Action / Outro
This episode is brought to you by ATP Gov. Visit us online at www.atpgov.com or follow us on LinkedIn.
Transcript
[00:00:00] Welcome to The Bottom Line Up Front, the podcast that cuts through the noise to deliver distilled insights from today’s most important technical webinars, presentations, and demonstrations. Designed for federal and military IT leaders, each episode breaks down complex technologies into mission-ready takeaways so you get the key points fast.
Whether it’s cybersecurity, cloud architecture, or emerging defense technologies, we highlight what matters most and how trusted integrators like ATPGov can help implement and operationalize these solutions across your agency or command. No fluff, no filler, just the bottom line up front. Today we’re diving back into the post-quantum cryptography world, talking about readiness and more specifically, how agencies can get visibility into the cryptography they already have deployed.
Because before you can modernize anything, you need to know what exists, where it lives, and how it behaves Problem at hand is you need [00:01:00] comprehensive cryptographic visibility. You need to build that roadmap. You need to line it with your high-value assets. It’s not a switch that you’re gonna be able to flip overnight.
This episode of The Bluff is based on a recent technical session with Tycon, a company that’s already operating across the US Army and is focused on cryptographic discovery and inventory at massive scale. And what they’re doing is becoming increasingly important as federal agencies try to align with NSM-10 and OMB M-2302, and a broader push toward quantum resilient architectures.
We’re focusing on NSM-10 and OMB-2302, you know, but NSM-10 has just been very, very clear. And the DOW CIO has been very, very clear. Discovery, inventory, roadmap. So let’s break down what Tycon actually brings to the table. At its core, Tycon is a cryptographic discovery and inventory platform, but it’s not doing this in the abstract.
It’s doing it at the [00:02:00] endpoint level across huge environments and without requiring agents. It leans on existing infrastructure to collect data from applications, protocols, key exchange algorithms, certificates, and more. It scores risk based on NIST standards, monitors posture changes over time, and feeds all of this into systems like Splunk or Elastic for further processing.
The important part is that it produces actionable outputs, not just dashboards, things like TLS upgrade recommendations, weak cipher identification, PQC readiness assessments, and even cost estimates for modernization. Tycon’s not just telling you what’s wrong, it’s giving you a path forward. And one of the strongest metaphors from the session was the iceberg problem, wherein agencies think they understand their cryptography, but that’s really only the top 10%.
The other 90% is buried in legacy systems, embedded devices, OT environments, hybrid cloud deployments, mission-critical applications, and tactical systems that have been around for decades. And if you don’t have visibility into that hidden [00:03:00] portion, you can’t assess risk, and you definitely can’t fix anything.
This is why Tycon’s approach aligns so tightly with federal mandates. NSM-10 and OMB M-2302 lay out a very clear sequence: discovery, inventory, and then roadmap. And right now, DoD isn’t prioritizing remediation. They’re prioritizing visibility and planning. So agencies need to know what they have before they can even begin to talk about modernization.
That said, Tycon has some real strengths. They have a massive DoD footprint, around 800,000 endpoints across Army environments. Their agentless architecture reduces friction in federal deployments, and their data is high fidelity and designed by former military cyber operators. They integrate with EMAS, which is critical for reporting, and they can help automate OMB reporting, which is a pain point for pretty much every agency right now, especially when everyone is starting with that 60-plus column DoD crypto inventory spreadsheet and wondering how they’re supposed to [00:04:00] populate it.
But let’s be honest, there are gaps. Discovery doesn’t automatically give you full asset context. You still need CMDB systems, EMAS integration, and human-defined tagging for HVAs and system IDs. Tycon solves visibility, but not complete asset intelligence. There’s also the software factory blind spot.
Agencies increasingly want code-level analysis, what crypto is embedded in the source code, how to refactor applications, how to future-proof systems. Tycon operates at runtime and not at the code base. And then there’s the ephemeral infrastructure challenge. Kubernetes, containers, and dynamic workflows that spin up, execute, and then disappear.
Crypto can exist in places that don’t persist long enough to be inventoried, and this is still an unsolved industry problem. So what’s the bottom line up front? You can’t modernize your cryptography until you understand where it exists. Federal mandates are forcing agencies to take action now, but discovery alone isn’t the finish line.
[00:05:00] Integration is everything, and the real fight isn’t compliance, it’s modernizing software and systems before quantum threats arrive. The ecosystems that succeed will be the ones that start with visibility, build newer crypto-agile ecosystems, and execute realistic phased roadmaps. Tools like Tycon are essential, but they’re only one piece of the equation.
Agencies need integrators who can help build full PQC readiness stacks using discovery tools, code analysis platforms, crypto agility solutions, and network layer protections. But they do need tools like Tycon that can enrich data across EMAS, ServiceNow, asset inventories, and software supply chain systems.
Overall, agencies need help turning raw discovery data into actual roadmaps, identifying high-value assets, prioritizing remediation, and building phased migration plans. Ultimately, they need support implementing modernization, upgrading TLS, keys, and certificates, refactoring applications, and redesigning architectures for PQC readiness.
[00:06:00] So if you’re in the DoD, federal civilian, or supporting national security missions, this isn’t a future problem. As we already know, it’s already here. And if you want help figuring out how tools like Tycon fit into your environment or how to build a complete PQC strategy, please don’t hesitate to reach out to ATPGov.
Be sure to reach out to ATPGov today at www.atpgov.com or email info@atpgov.com or check us out on social media on LinkedIn. Thanks for listening, and be sure to subscribe to the Bottom Line Up Front wherever you get your podcasts, and stay tuned for more distilled insights from the front lines of tech and national security.
So until next time, stay secure, stay mission ready.
About this Podcast
The Bottom Line Up Front, is ATP Gov’s podcast that cuts through the noise to deliver distilled insights from today’s most important technical webinars, presentations and demonstrations designed for federal and military IT leaders. Each episode breaks down complex technologies into mission ready takeaways, so you get the key points.
Fast.
Whether it’s cybersecurity, cloud, architecture, or emerging defense technologies, we highlight what matters most and how trusted integrators like ATP Gov can help implement and operationalize these solutions across your agency or command.
No fluff. No filler, just the bottom line up front.
