Software developers face gaps in migrating to post-quantum cryptography

R.D.N. Shakya of RMIT University, Craig Costello, and Nalin A.G. Arachchilage have completed a Systematisation of Knowledge (SoK) revealing that simply having standardised post-quantum cryptography (PQC) algorithms is insufficient for securing software. Their analysis demonstrates that existing approaches to PQC integration provide “disconnected support across the software development lifecycle,” failing to coordinate preparation, implementation, and ongoing maintenance. The work shows evaluation evidence for PQC integration largely remains limited to controlled settings, indicating a stronger demonstration of technical feasibility than proof of operational readiness for real-world deployment. While the standardization of post-quantum cryptography (PQC) algorithms is underway, a comprehensive examination of their integration into existing software development processes reveals critical gaps in practical application. This analysis focused on approaches to implementation, migration and developer education, assessing them against NIST PQC standards and existing migration guidance. Current developer education initiatives, while introducing concepts like quantum threats and PQC protocols, often fall short of equipping developers…