PQC-Day and the Machine: Decisions, code and lessons from a post-quantum readiness platform with AI (The Professional and the Machine)

The cryptography protecting your organization has an expiration date.When a sufficiently powerful quantum computer exists, RSA, ECDSA, and Diffie-Hellman will stop protecting anything. That day is called PQC-Day. Intelligence agencies are already storing encrypted traffic today to decrypt it tomorrow.This book documents the real-world construction of a SaaS platform for post-quantum assessment powered by AI. From automated inventory of vulnerable cryptography to migration roadmaps prioritized by regulatory risk.What will you learn?What Shor breaks and what Grover weakens — no math, just practical consequencesBuild a scanner that detects RSA, ECDSA, DH, MD5, and SHA-1 in code repositoriesAnalyze SSL/TLS certificates and determine which ones won't survive past 2030Audit the cryptography of cloud environments (AWS KMS, Azure Key Vault, GCP)Design an autonomous agent with Claude Agent SDK that classifies cryptographic findingsImplement specialized RAG over NIST, ENISA documentation and PQC regulatory frameworksMap findings to NIS2 and DORA controls with auditable evidenceGenerate prioritized migration roadmaps using the Europol frameworkGovern AI usage with token tracking, cost management, and per-service auditingDeploy the platform with Docker Compose: 7 services, multi-tenant, 5 RBAC roles26 technical chapters across 9 partsEach chapter follows the same structure: the concept, the architectural decision with discarded alternatives, and the implementation with didactic code.Part I — The quantum threat: Shor, Grover, Harvest Now Decrypt Later · Part II — Architecture: multi-tenant, data model, security · Part III — Analysis engines: code, certificates, cloud, and OWASP · Part IV — AI: semantics with LLMs, autonomous agent, RAG, governance · Part V — Compliance: NIS2, DORA, NIST FIPS 203/204/205, roadmap · Part VI — Frontend: PQC dashboard and AI chat · Part VII — Deployment: Docker, Celery, observability · Part VIII — The business: SaaS model and market · Part IX — The cryptographer of the futureWritten with verifiable data, not quantum hypeFIPS published in August 2024, DORA in effect since January 2025, European cryptographic inventory mandatory by December 2026. The limitations of AI are documented with the same honesty as its successes.Code available in the public repository: github.com/machinebooksWho is this for?CISOs facing NIS2/DORA deadlines who don't know where to start with PQCSecurity architects who need cryptographic inventory toolsConsultants looking to offer post-quantum assessment servicesCTOs in banking, insurance, healthcare, and critical infrastructureBook #5 in "The Professional and the Machine" series, which also includes The Architect and the Machine, The Pentester and the Machine, The CISO and the Machine, The Cyber Range and the Machine, and The User and the Machine. Each book is standalone.Includes glossary, 5 reference appendices, and 8 architecture diagrams.About the authors: Carlos Pérez González, AI solutions architect with over two decades in offensive cybersecurity (OSCE, OSCP, OSWE, OSEP). Founder of ihacklabs, acquired by Telefónica in 2020. Juan Carlos Montes Senra, cybersecurity architect with a forensic and offensive profile (GCFA, GREM), published in PHRACK #65. Read more