PQC-Day and the Machine: Decisions, code and lessons from a post-quantum readiness platform with AI (The Professional and the Machine)

The cryptography protecting your organization has an expiration date. When a sufficiently powerful quantum computer exists, RSA, ECDSA, and Diffie-Hellman will stop protecting anything. That day is called PQC-Day. Intelligence agencies are already storing encrypted traffic today to decrypt it tomorrow. This book documents the real-world construction of a SaaS platform for post-quantum assessment powered by AI. From automated inventory of vulnerable cryptography to migration roadmaps prioritized by regulatory risk. What will you learn? What Shor breaks and what Grover weakens — no math, just practical consequences Build a scanner that detects RSA, ECDSA, DH, MD5, and SHA-1 in code repositories Analyze SSL/TLS certificates and determine which ones won't survive past 2030 Audit the cryptography of cloud environments (AWS KMS, Azure Key Vault, GCP) Design an autonomous agent with Claude Agent SDK that classifies cryptographic findings Implement specialized RAG over NIST, ENISA documentation and PQC regulatory frameworks Map findings to NIS2 and DORA controls with auditable evidence Generate prioritized migration roadmaps using the Europol framework Govern AI usage with token tracking, cost management, and per-service auditing Deploy the platform with Docker Compose: 7 services, multi-tenant, 5 RBAC roles 26 technical chapters across 9 parts Each chapter follows the same structure: the concept, the architectural decision with discarded alternatives, and the implementation with didactic code. Part I — The quantum threat: Shor, Grover, Harvest Now Decrypt Later · Part II — Architecture: multi-tenant, data model, security · Part III — Analysis engines: code, certificates, cloud, and OWASP · Part IV — AI: semantics with LLMs, autonomous agent, RAG, governance · Part V — Compliance: NIS2, DORA, NIST FIPS 203/204/205, roadmap · Part VI — Frontend: PQC dashboard and AI chat · Part VII — Deployment: Docker, Celery, observability · Part VIII — The business: SaaS model and market · Part IX — The cryptographer of the future Written with verifiable data, not quantum hype FIPS published in August 2024, DORA in effect since January 2025, European cryptographic inventory mandatory by December 2026. The limitations of AI are documented with the same honesty as its successes. Code available in the public repository: github.com/machinebooks Who is this for? CISOs facing NIS2/DORA deadlines who don't know where to start with PQC Security architects who need cryptographic inventory tools Consultants looking to offer post-quantum assessment services CTOs in banking, insurance, healthcare, and critical infrastructure Book #5 in "The Professional and the Machine" series, which also includes The Architect and the Machine, The Pentester and the Machine, The CISO and the Machine, The Cyber Range and the Machine, and The User and the Machine. Each book is standalone. Includes glossary, 5 reference appendices, and 8 architecture diagrams. About the authors: Carlos Pérez González, AI solutions architect with over two decades in offensive cybersecurity (OSCE, OSCP, OSWE, OSEP). Founder of ihacklabs, acquired by Telefónica in 2020. Juan Carlos Montes Senra, cybersecurity architect with a forensic and offensive profile (GCFA, GREM), published in PHRACK #65.