How to scan your codebase for post-quantum cryptographic risk

If you've been following NIST's post-quantum cryptography standardization process, you already know the threat is real. In August 2024, NIST finalized the first three PQC standards: ML-KEM (CRYSTALS-Kyber), ML-DSA (CRYSTALS-Dilithium), and SLH-DSA (SPHINCS+). But here's the problem most engineering teams face: they don't know what cryptography is actually running in their codebase. Why this matters now The "harvest now, decrypt later" attack is already happening. Nation-state actors are collecti