tech · quantum risk
Is M&A crypto DD Quantum Proof? Cyber Program & PQC
Verdict
M&A due diligence should include cryptographic inventory samples, key custody, and product algorithm claims. Quantum risk is part of technology debt pricing.
Overview
Buyers inherit CAs, customer TLS promises, and OT gear. Price remediation into deals.
Program inventory focus: Acquisitions import unknown classical crypto debt. Typical classical surfaces: Acquired PKI, code-signing, product TLS. Cross-read /security/program and /assessment. Educational only—not compliance advice.
Cryptographic profile
- Signatures: Acquired PKI, code-signing, product TLS
- Hash: DD artifact set
- Public-key exposure: Acquisitions import unknown classical crypto debt.
What breaks
- Only appsec questionnaire
- No code-signing review
Mitigations
- Crypto DD checklist
- Day-1 integration of inventory
- Escrow and key custody review
FAQ
Startups without PKI docs?
Higher residual—budget discovery post-close.
Open source products?
Review shipped crypto libs and update channels.
Key concepts (technical dictionary)
Terms used on this page — open a definition: