About
LaMarr Labs exists because the organizations with the most quantum cryptographic exposure have the least operational clarity on what the transition actually requires.
A small, senior team. Advisory led by Addie LaMarr. Technical infrastructure supported by a CTO with backgrounds at Google and Citibank.
The Perspective Behind the Framework
Addie LaMarr built the Quantum Risk Migration Framework from a vantage point most advisory firms cannot replicate.
Eight years as a COMSEC Specialist in the United States Air Force: Wing-level cryptographic infrastructure, key material management under NSA directives, cryptographic incident investigation, and semi-annual account inventories across a multi-site operational environment. Then DOJ: advisor to the FBI CISO and the Office of Justice Programs CISO on enterprise security strategy, author of cybersecurity policy for DOJ components, and direct contributor to the NIST High Value Asset federal cybersecurity policy project.
That background shaped the methodology. Cryptographic risk in enterprise environments rarely lives where the documentation says it does. It lives in the vendor-managed TLS endpoint that never got explicitly scoped, the encrypted backup infrastructure that predates the current key management policy, the certificate authority three separate teams assume someone else is monitoring. The pattern recognition that finds those gaps comes from having been responsible for them, not from having studied them.
LaMarr Labs works with financial services firms, life sciences organizations, critical infrastructure operators, and complex enterprise environments where the cryptographic migration problem is genuinely hard: vendor-controlled surfaces, long-lived sensitive data, regulatory accountability, and procurement constraints that make “just migrate” the wrong frame.
The design of this practice follows from a specific conviction: the data being protected is real, and the failure modes in cryptographic governance have real consequences. The four-client limit, the structural independence from vendors and implementation, and the explicit handling of unknowns all follow from taking that seriously.
What Guides This Work
Visibility before action
Cryptographic decisions that cannot be traced to verified evidence don't drive migration roadmaps at LaMarr Labs. They drive discovery work. When evidence is missing, the accurate label is Unknown. That label prevents downstream decisions from being built on false confidence.
Governance before engineering
Post-quantum transition fails at the governance layer before it fails at the technical layer. Unclear ownership, vendor dependencies that weren't mapped, and migration sequences that don't account for contractual constraints produce planning documents that engineering teams cannot execute.
Independence from vendors and implementation
LaMarr Labs does not sell tools, resell vendor products, or bundle implementation into advisory retainers. The roadmap must be credible when it recommends not migrating certain systems, delaying certain waves, or applying vendor pressure that the vendor would not prefer.
Decision-grade clarity, not analytical coverage
The deliverable is not the most comprehensive possible description of the cryptographic estate. It is the minimum viable clarity that lets the board approve investment, the engineering team execute a sequence, and procurement apply appropriate vendor pressure. Volume is not the product. Decisions are.