Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How Quantum-Safe Encryption Is Becoming an Enterprise Imperative
Transcript
- Lucas: So, in late 2026, the phrase 'crypto-agile' has moved from a nice to have in security architecture to something closer to a survival skill. And it's all because quantum computing is no longer a purely theoretical threat to the encryption that holds the internet together. Luna: Right, and for listeners who haven't been tracking this, can we just be clear about the actual danger? It's not that a quantum computer is going to magically decrypt everything tomorrow. The threat is more nuanced. Lucas: Exactly. The real risk is what security researchers call 'harvest now, decrypt later'. An attacker can quietly collect encrypted data today — traffic, stored files, communications — and just sit on it. When a sufficiently powerful quantum computer finally exists, they break the encryption retroactively. And suddenly, everything you encrypted in 2026 is readable in 2035. Luna: So it's not about protecting data in motion for the next five years. It's about protecting data that will still be sensitive in twenty years. That changes the calculus pretty dramatically for certain industries. Lucas: Exactly. And that's why the National Institute of Standards and Technology — NIST — finalized three post-quantum encryption standards back in August 2024. That was the starting gun. Those standards give us the algorithms that are supposed to be resistant to quantum attacks. The problem is, very few organizations have actually done the work to adopt them. Luna: And that's the gap I find fascinating. The standards exist. The threats are known. Yet the migration is painfully slow. Why is that? Lucas: Because it's not a simple software patch. Think about everything that relies on public-key cryptography. TLS certificates for web traffic. Code signing. Email signing. VPN handshakes. The entire PKI ecosystem. And that's before we get into the long-term data archives. Luna: So it's a whole infrastructure problem, not just an encryption problem. And that's where the real cost and complexity live. Lucas: Yeah, and the industry is calling this 'crypto agility'. The capacity to swap out one cryptographic algorithm for another, without rebuilding the entire system from scratch. Most existing systems were never designed for that. They were built with one algorithm baked in, and that was it. Luna: That sounds like a recipe for some serious technical debt. So what does a CISO actually do about this? Where do you even start? Lucas: Well, the first step is what's called a cryptographic inventory. You need to know where every key is generated, where it's stored, and where it's used. And for most large organizations, that's a surprisingly difficult task. They simply don't have complete visibility into their own key management. Luna: Right, because keys are often scattered across legacy systems that nobody fully understands anymore. So the inventory alone is a project in itself. Lucas: Precisely. And once you have the inventory, you need to prioritize. Not everything needs quantum-safe encryption tomorrow. A bank's transactional data from last week? Probably not top priority. But a pharmaceutical company's clinical trial results? Or a defense contractor's system designs? Those have a much longer shelf life. Luna: So it's about the data's lifespan and its sensitivity. That's a completely different risk model than most security teams are used to. Lucas: And that's the shift I think is really important. Classic security thinking is about protecting today's attack surface. Quantum-safe encryption forces you to think about the value of your data twenty years from now. Luna: You know, this is one of those show topics where I keep a running list of things I've learned that I actually use. And this is one of them. Honestly, if this conversation was worth a coffee to you, we'd love that. There's a link on our show page: buy me a coffee dot com slash fexingo. It helps us keep this show ad-free and focused on the real operational details like this one. Lucas: That's a nice way to put it, Luna. And it genuinely does help us keep digging into topics like this. So, back to the technical roadblock. There's a clever interim solution that's gaining traction, called hybrid certificates. You basically have a certificate that contains both a classic algorithm and a post-quantum one. Luna: So you're protected against both the current threats and the future quantum one, without having to fully commit to the migration right away. That sounds like a pragmatic bridge. Lucas: It is. And it's actually what a lot of major tech companies have been doing in their internal infrastructure for a couple of years now. The big cloud providers are already offering hybrid key exchange options in their SDKs, so their customers can start experimenting without a forklift upgrade. Luna: So the tools are starting to be available. But I imagine the real pain is in the enterprise PKI systems that have been running for decades. Lucas: Absolutely. Replacing every X.509 certificate in an organization, or updating the certificate authorities themselves, is a logistical nightmare. And that's just certificates. The harder part is the data that's already encrypted and stored. You can't migrate that with a new certificate. You have to decrypt it, re-encrypt it with the new algorithm, and do it in a way that doesn't expose the data during the transition. Luna: That's a serious migration project. And it's not something you do overnight. So what's a realistic timeline for a large enterprise? Lucas: Well, if you look at the banking sector, regulators are starting to push for quantum-readiness by the mid-2030s. That gives them about eight to ten years. But the actual technical work is going to take most of that time. The planning has to start now. Luna: So if you're a CISO in 2026, you really should have already started the inventory and the risk assessment. Not because the quantum computer is imminent, but because the migration is that slow. Lucas: Exactly. And the cost is not trivial either. But the cost of not doing it is potentially catastrophic. Imagine a breach in 2035 where the attackers decrypt your encrypted backups from 2026. The data loss would be historical. Luna: So what about the industries that are most exposed? I'd imagine defense, finance, healthcare, and maybe energy are at the top of the list. Lucas: Definitely those. And also any company that handles intellectual property that retains value over decades, like technology patents or proprietary manufacturing processes. There's also the legal profession. Attorney-client privilege is designed to last indefinitely, so a law firm's case files from 2026 are still sensitive in 2040. Luna: And for those organizations, the standard approach is to start with a cryptographic inventory and then focus on the data that has the longest shelf life. But I've also heard of something called 'crypto-agile' systems that are designed to make this easier. How does that work in practice? Lucas: So crypto agility really means building systems that allow you to swap algorithms without rewriting code. For example, instead of hardcoding a specific encryption algorithm, you use a cryptographic library that can be updated at runtime. So when a new algorithm is needed, you can deploy it as a configuration change, not a code rewrite. Luna: That's the kind of flexibility that most enterprise systems just don't have. So it's a long-term architectural goal rather than a quick fix. Lucas: Right. And even the standards themselves are evolving. NIST is still evaluating additional algorithms, especially for things like digital signatures, which are trickier to make quantum-resistant. The current standards focus on encryption and key exchange, but signature algorithms like Falcon and SPHINCS+ are still being finalized. So the migration is happening in waves. Luna: And I think that's a good thing — it gives organizations a chance to phase their approach instead of trying to swallow the entire elephant at once. Lucas: Exactly. And the smartest CISOs are already using this phased approach. They're building crypto-agility into any new systems they deploy today. So even if they're not fully quantum-safe yet, they're positioning themselves to be able to flip the switch when the time comes. Luna: That makes sense. You don't want to be scrambling in 2033 to re-architect a system that you're deploying today. Lucas: Right. And there's an interesting side benefit to this whole exercise. Doing a thorough cryptographic inventory often reveals shadow IT and legacy systems that the security team didn't even know about. So the migration forces a level of hygiene that's valuable in itself. Luna: So the journey to quantum-safe encryption is also a journey to better overall security. That's a nice way to frame it for a business audience. Lucas: And I think that's the key takeaway for this episode. Post-quantum cryptography isn't just a technical checkbox. It's a strategic project that touches every part of your enterprise. The timelines are long, the costs are real, but the cost of ignoring it is far worse. Luna: So what would you tell a CISO who's listening and hasn't started yet? What's the single most important first step? Lucas: Start the inventory. You can't protect what you can't see. And if you don't even know where your encryption keys are, you have no hope of migrating them. So go map your cryptographic footprint. That's the first, most concrete move. Then you can prioritize based on data sensitivity and lifespan. Luna: And that's the kind of practical nuance we like to dig into here. So for our listeners, if you're in charge of security strategy, the clock is ticking on quantum readiness. It's not panic time, but it is definitely planning time. Lucas: Couldn't agree more. And on that note, we'll leave it there. Thanks for joining us on this deep dive into the business of post-quantum security.