# What is crypto-agility?

Crypto-agility is the ability to change the cryptographic algorithms a system uses without rewriting or replacing the system. In practice it means that algorithms are chosen by configuration, not hard-coded; software uses maintained libraries that receive new algorithms through updates; certificates and keys are managed centrally, with known owners and expiry dates; and you know where each algorithm is used. It matters now because the post-quantum transition will not be the last one: HQC and FN-DSA are still coming, parameters may be revised, and a flaw could appear in a young implementation. An organisation that makes one painful, manual migration will face the same pain next time; one that builds agility turns the next change into a configuration release. Ask about it in every purchase: can the product change its key-exchange and signature algorithms by update or setting, and does the vendor commit to doing so? A product that cannot is a migration problem you are buying today.

FAQ: [Post-quantum cryptography](https://netsenx.com/en/faq/pqc) · https://netsenx.com/en/faq/what-is-crypto-agility

## Read next

- https://netsenx.com/en/encrypted-traffic-analysis
- https://netsenx.com/en/features
- https://netsenx.com/en/blog/2026-10-27_harvest-now-decrypt-later

## Related questions

- [Do SSH and VPNs support post-quantum key exchange?](https://netsenx.com/en/faq/do-ssh-and-vpns-support-post-quantum-key-exchange)
- [How can we find where we use quantum-vulnerable cryptography?](https://netsenx.com/en/faq/how-to-find-quantum-vulnerable-cryptography)
- [Can a network sensor build a cryptographic inventory?](https://netsenx.com/en/faq/can-a-network-sensor-build-a-cryptographic-inventory)
- [How do I find which connections already use hybrid key exchange?](https://netsenx.com/en/faq/which-connections-already-use-hybrid-key-exchange)
- [What should a cryptographic inventory include?](https://netsenx.com/en/faq/what-should-a-cryptographic-inventory-include)