Beyond post-quantum cryptography, Grieve sees an opportunity for organisations with particularly demanding security requirements to begin evaluating quantum-based security technologies.
“ When it comes to quantum security, as in quantumbased security such as QKD, I think it is a good time to start exploring these technologies and solutions.”
For large organisations operating critical infrastructure or environments with high information assurance requirements, that exploration can begin with targeted deployments rather than wholesale transformation.
“ For large organisations, particularly those operating in critical domains or with very high information assurance requirements, it is a good time to start exploring this through targeted deployments or by strengthening very specific parts of their infrastructure”
Migrating without breaking the business
Knowing where vulnerable cryptography resides is only the beginning. Enterprises must then determine what to migrate first without disrupting systems that may support critical business operations.
Kris Voorspoels, Director of Products & Solutions, OPSWAT, argues that organisations do not need to replace every cryptographic system simultaneously. Instead, migration should be prioritised according to the sensitivity and useful life of data, its exposure to interception and the consequences of disrupting the systems supporting it. combining classical and post-quantum cryptography. Organisations could then evaluate interoperability, latency, monitoring and recovery under real-world conditions before expanding deployment.
A threat that has already begun
The urgency surrounding migration is rooted in the longevity of sensitive information. Even if practical quantum attacks remain years away, data intercepted today may still have value when those capabilities emerge.
Melchor said:“ Harvest now, decrypt later”( HNDL) makes the quantum threat a present-day risk, not a future one. Adversaries are intercepting encrypted data today; if that data has a long shelf-life – like intellectual property, financial records, or state secrets – its confidentiality is already on a ticking clock.”
Pandya believes migration can be managed without creating widespread disruption, provided it is engineered carefully.
“ PQC migration doesn’ t necessarily have to be highly disruptive, but it does need to be engineered. Encryption is already embedded in enterprise systems, so the task is to introduce standards-based quantum-safe algorithms without breaking compatibility or service continuity.”
His recommendation is to begin with valuable, long-lived information and the systems protecting it, before working through vendor dependencies, PKI, certificate management and hybrid implementations.
PQC migration doesn’ t necessarily have to be highly disruptive, but it does need to be engineered.
“ That means beginning with information that must remain confidential for many years: intellectual property, government or defence data, patient and financial records, strategic plans and information relating to mergers and acquisitions. Organisations should then trace where that data travels. These are often the areas where“ harvest now, decrypt later” creates the greatest risk.”
“ The good news is that you don’ t have to start from scratch. NIST standards such as ML-KEM, ML-DSA and SLH-DSA give organisations a practical direction. The real goal is crypto-agility. Algorithms, certificates and keys should be replaceable without redesigning every application. That reduces harvest now, decrypt later exposure, today, while giving the business room to migrate at a pace operations can absorb.”
Kris Voorspoels, Director of Products & Solutions, OPSWAT
This also makes post-quantum migration an enterprise-wide issue rather than solely a cybersecurity project. Network engineers, application owners, infrastructure teams, procurement leaders and technology suppliers all have roles in understanding data flows, technology dependencies and safe upgrade windows.
Voorspoels believes initial deployments can be deliberately limited. A high-value connection between a data centre and cloud environment, for example, could be protected using a hybrid approach
The post-quantum transition is therefore less about predicting exactly when quantum computers will threaten existing encryption and more about ensuring organisations are ready when they do. For CISOs, the immediate task is visibility: understanding what cryptography exists, what it protects and how long that protection must last. From there, enterprises can prioritise their most exposed assets, test new approaches and build the cryptographic agility required for a security landscape in which the algorithms protecting today’ s data may no longer be sufficient tomorrow.
Dr James A. Grieve, Senior Director of Quantum Communications at the Technology Innovation Institute
WWW. INTELLIGENTCISO. COM / MIDDLE-EAST 27