We get the same questions in almost every engagement now. Which post-quantum primitive should we pick? When do we hybridize, and when do we stop? How do we migrate TLS without breaking production? Which library can we trust? What should we test for? The answers have stabilized enough that writing them down once feels more useful than reciting them in another kickoff call.
So we did. The Post-Quantum Migration Playbook is a 52-page guide for the engineer or architect who has been told their system needs to be “post-quantum ready” and is now trying to figure out what that actually means in practice. It is organized around decisions rather than theory. Each chapter is short, scoped to a single migration concern, and ends with our recommendation and the contingency it depends on. Skim the TL;DR boxes if you only have ten minutes; the Pitfall boxes for mistakes we watch teams stumble into; the From the audit floor boxes for the bug classes we have actually found in production code, anonymized but real.
The topics are what you would expect: choosing primitives, when hybrid constructions are worth their cost (KEMs yes, signatures usually no), TLS and PKI migration, secure messaging, which libraries are worth using, conformance testing with Crucible, rollout strategy, and a closing gallery of bug classes. None of it is new research. Most of it is the stuff our clients keep wishing someone had handed them at the start.
The Companion Scorecard
We also built a small site to go with it: pq-migration.symbolic.software. Twelve questions, three minutes, no signup, and you get a verdict across six dimensions of post-quantum readiness. There is also a one-host TLS scanner that checks what your endpoint actually negotiates, in case it doesn’t match what your team thinks.
If you read the playbook and want to talk about your specific system, get in touch. The whole reason this is a guide and not a checklist is that the right answers depend on context.