Assessing Organizational Readiness for Quantum Threats

Bank for International Settlements – BIS has published "Quantum-readiness for the financial system: a roadmap" The document counts with well-known experts as co-authors: Raphael Auer, Andras Valko (BIS), Angela Dupont (BIS and Banque de France), Maryam Haghighi, Danica Marsden (Bank of Canada), Sarah McCarthy (University of Waterloo) , Donna F. Dodson, and Nicolas Margaine. It provides a comprehensive overview of the #QuantumSafety topic and how it applies to the financial sector systemically and to financial organizations individually. It is useful and insightful, including the most mature thought leadership. Some highlights on general messages: 👉 Trust in the financial system is fundamentally tied to the trust provided by cryptography. 👉 Implementation challenges require coordinated planning and bring an opportunity to build more resilient infrastuctures. 👉 In line with the Canadian roadmap, it emphasizes implementing robust governance structures. 👉 It recommends the implemantation of crypto-agility, understood as per the definition created by the FS-ISAC PQC WG (https://lnkd.in/dgzW_rn8). On "A systemic roadmap": 👉 The document underlines the need for a coordinated and proactive action plan by central banks, supervisory authorities and financial institutions around the world. 👉 Warns about the risk of dual-speed transitions: "In the absence of coordination, actors that are not adequately protected against the quantum threat could become weak links, impacting the security of the entire financial system." 👉 While not suggesting a timeline, the document calls for global alignment: "During the planning phase participants in the financial system translate the jointly agreed priorities and requirements into a system-level migration timeline and a set of common technical choices". 👉 It also recommends protections against the doom of backwards compatibility: "a cut-off date for phasing out legacy cryptographic protocols needs to be approved by all organisations that use those protocols". 👉 And covers the importance of cross-border alignment: "domestic plans need to be aligned with transition plans in other jurisdictions and in cross-border systems, such as multi-currency payment and settlement infrastructures". On organizations' roadmaps: 👉 Underlines the need to appoint an executive leader responsible for driving the programme. 👉 "Forming a dedicated, cross-functional team is essential in this initial phase. This team should include representatives from technology, legal, human resources, finance, operations and security departments". On responsibilities: 👉 "Central banks, as pivotal entities in the global financial system, are well positioned to support and lead the way to increased resilience. [...] Central banks can promote a proactive, systemic approach and help create the alignment necessary for coordinated action across the global financial system". https://lnkd.in/dU4fS4TX

EY’s perspective on securing against #quantum #risks emphasizes that quantum #computing is rapidly evolving from a theoretical concern into a material cybersecurity threat that requires immediate strategic action. The core issue lies in the vulnerability of widely used cryptographic algorithms, such as RSA and elliptic curve cryptography, which could be broken by sufficiently advanced quantum computers. This creates a systemic risk to sensitive data, including financial information, intellectual property, and personal records. A central concept highlighted is the “harvest now, decrypt later” threat model, in which adversaries collect encrypted data today with the intention of decrypting it in the future as quantum capabilities mature. This makes quantum risk a present-day problem, particularly for data requiring long-term confidentiality. EY stresses that organizations must adopt a proactive and structured approach to quantum readiness. A foundational step is to conduct a comprehensive cryptographic inventory, identify sensitive #data, and map existing #encryption methods. This enables organizations to assess which systems are most exposed and prioritize remediation efforts. Transitioning to post-quantum cryptography (PQC) is a complex, multi-year transformation that requires careful planning, integration into existing #technology roadmaps, and alignment with emerging standards. Organizations are encouraged to build crypto-agility, allowing them to adapt encryption methods as technologies and standards evolve. EY also highlights the importance of #governance, #compliance, and #workforce readiness. Quantum resilience requires enterprise-wide coordination, including policy development, regulatory alignment, continuous monitoring, and personnel training. EY frames quantum cybersecurity not just as a technical upgrade but as a strategic #transformation initiative. Organizations that act early can strengthen resilience, improve cyber maturity, and gain a competitive advantage, while those that delay risk long-term exposure to data breaches, regulatory challenges, and erosion of #digital #trust.

🔐Europol PRIORITISING POST-QUANTUM CRYPTOGRAPHY MIGRATION ACTIVITIES IN FINANCIAL SERVICES ⚛️As post-quantum cryptography (PQC) becomes integrated into mainstream information technology (IT) products and services, financial services institutions must begin to execute their transition strategies. This document provides actionable guidelines to incorporate quantum safety into existing risk management frameworks by assessing the ‘Migration Priority’ based on the ‘Quantum Risk’ and ‘Migration Time’ of business use cases and highlighting opportunities for immediate execution. ⚛️A critical first step is to inventory all business use cases that rely on public key cryptography. This inventory enables the creation of a prioritised transition roadmap by assessing the Quantum Risk of each use case based on three parameters: 🟣 Shelf Life of Protected Data: How long the data remains sensitive. 🟣 Exposure: The extent to which data is accessible to potential attackers. 🟣 Severity: The business impact of a potential compromise. ⚛️When the Quantum Risk is assessed, organisations can prioritise actions based on each use case’s Migration Time, i.e., the complexity and timeline required to achieve Quantum Safety for a use case. As part of this activity, organisations will identify, for instance, actions that can be launched immediately and the use cases that require coordination with long-term asset lifecycles. 🟣 Solution Availability: Maturity of PQC standards, and their general availability in products and services. 🟣Execution Cost: The effort, cost, and complexity of implementing the quantum-safe solutions within the organisation. 🟣 External Dependencies: Execution complexity due to coordination required with third parties and their transition roadmaps (standardisation bodies, vendors, peers, regulators, and customers). ⚛️Examples of use cases that financial organisations can begin implementing today include: 🟣 Integration of post-quantum requirements into the long-term roadmap for hardware-intensive use cases aligned with financial asset lifecycles. 🟣 Enhancement of confidentiality protection for transactional websites. 🟣Identification and elimination of cryptographic antipatterns to reduce future technical debt. ⚛️These are examples of how financial institutions can take timely, structured steps toward an efficient and forward-looking transition to post-quantum cryptography. https://lnkd.in/d4qiS6X9

Deloitte Urges Organizations to Prepare for Post-Quantum Cryptography Quantum Threats to Cryptography In its annual Tech Trends report, Deloitte highlights the looming cybersecurity threat posed by quantum computers. These fast-calculating machines could soon break traditional public-key cryptography, which underpins secure communications and data protection. To safeguard against this risk, Deloitte recommends that organizations take immediate steps to inventory and update their cryptographic systems with quantum-resistant algorithms. A Y2K-Like Urgency Deloitte likens the need for proactive quantum encryption updates to the urgency of addressing the Y2K problem in the late 1990s. Similar to how companies scrambled to fix date-related programming issues to avoid catastrophic failures, today’s IT teams must preemptively tackle the vulnerabilities quantum computing may introduce. The comparison underscores the scale and urgency of the effort required to prevent future security breaches. NIST’s Post-Quantum Encryption Standards The National Institute of Standards and Technology (NIST) has already released post-quantum encryption standards to guide organizations. Tech giants such as Apple, Google, and Microsoft have begun incorporating quantum-ready encryption into their products and platforms, signaling the importance of early adoption. Deloitte’s report emphasizes that businesses must align with these standards to future-proof their cryptographic infrastructure. Tools for Cryptographic Transition To aid organizations in this transition, Deloitte points to resources such as NIST’s National Cybersecurity Center of Excellence. This center offers cryptographic discovery and inventory tools that help identify outdated encryption methods and streamline the process of upgrading to quantum-resistant systems. These tools are critical for managing the complexity of securing vast digital infrastructures. The Need for Proactive Action Deloitte stresses the importance of taking immediate, proactive measures to address this emerging challenge. Organizations should prioritize assessing their cryptographic systems, investing in quantum-resistant solutions, and adopting NIST-recommended practices. Early preparation will minimize risks and ensure a smoother transition as quantum computing capabilities evolve. Conclusion The rise of quantum computing presents a significant threat to traditional cryptographic systems, requiring organizations to adopt quantum-resistant encryption. Deloitte’s comparison to Y2K highlights the urgency and scale of this challenge. By leveraging NIST standards, adopting available tools, and taking proactive steps, businesses can mitigate risks and prepare for a quantum-driven future in cybersecurity.

In the last six months, I have sat in boardrooms in Washington D.C., Sydney, and London. The quantum conversation is happening in all of them. But it is the wrong conversation. The conversation that is happening: When do we need to start paying attention to #quantum? The conversation that needs to happen: What does our fiduciary exposure look like if we have not documented our quantum risk posture, when NIST has published the standards, CISA has issued guidance, and our prime contractor introduces a qualification requirement next quarter? I have worked across six countries and three technology waves. Semiconductors in Japan. Industrial AI in Germany and Switzerland. Quantum, now, across Washington D.C., Sydney, and the industrial corridors of every economy moving to secure its production future. The pattern is identical every time. The boards that ask the first question are always surprised by the second. The boards that ask the second question are never caught unprepared. The economic logic is not complicated. National Institute of Standards and Technology (NIST) published post-quantum cryptography standards. That publication creates a foreseeable risk, the kind that triggers fiduciary duty. A board that has not assessed the organization's exposure to that risk cannot credibly argue it exercised reasonable care. This is not a technology governance question. It is a risk governance question that happens to have a technology dimension. The technology is never the bottleneck. The bridge to the factory floor is. Right now, the most important bridge runs through the boardroom, not the lab. LFI's #Board Quantum Readiness Workshop equips boards and C-suites with the economic framework to govern quantum investment timing and organizational readiness in a half-day or full-day facilitated session. The Risk Radar Enterprise Assessment produces the board-ready quantum risk register that documents your organization's exposure across IP, operations, supply chain, and regulatory obligations. Both are designed to be the answer to the right question, before the right question arrives uninvited. If your board reviewed your organization's quantum risk posture tomorrow, what document would you hand them, and does it currently exist? #BoardGovernance #FiduciaryDuty #IndustrialEconomics #QuantumRisk #ManufacturingLeadership #StrategicEntanglement

🔑"𝐇𝐚𝐫𝐯𝐞𝐬𝐭 𝐍𝐨𝐰, 𝐃𝐞𝐜𝐫𝐲𝐩𝐭 𝐋𝐚𝐭𝐞𝐫" (𝐇𝐍𝐃𝐋) attacks intercept RSA-2048 or ECC-encrypted files, stockpiling them for future decryption. Once a powerful quantum computer comes online, they can unlock those archives in hours, exposing years’ worth of secrets. This silent threat targets everything from personal records to diplomatic communications. 🔐 📌 HOW CAN CYBERSECURITY LEADERS AND EXECUTIVES PREPARE? 🎯🎯𝐁𝐮𝐢𝐥𝐝 𝐂𝐫𝐲𝐩𝐭𝐨𝐠𝐫𝐚𝐩𝐡𝐢𝐜 𝐀𝐠𝐢𝐥𝐢𝐭𝐲: Ensure your systems can swiftly swap out cryptographic algorithms without extensive re-engineering. 𝐂𝐫𝐲𝐩𝐭𝐨-𝐚𝐠𝐢𝐥𝐢𝐭𝐲 𝐢𝐬 𝐭𝐡𝐞 𝐚𝐛𝐢𝐥𝐢𝐭𝐲 𝐭𝐨 𝐫𝐚𝐩𝐢𝐝𝐥𝐲 𝐭𝐫𝐚𝐧𝐬𝐢𝐭𝐢𝐨𝐧 𝐭𝐨 𝐮𝐩𝐝𝐚𝐭𝐞𝐝 𝐞𝐧𝐜𝐫𝐲𝐩𝐭𝐢𝐨𝐧 𝐬𝐭𝐚𝐧𝐝𝐚𝐫𝐝𝐬 𝐚𝐬 𝐭𝐡𝐞𝐲 𝐛𝐞𝐜𝐨𝐦𝐞 𝐚𝐯𝐚𝐢𝐥𝐚𝐛𝐥𝐞. Designing for agility now will let you plug in PQC algorithms (or other replacements) with minimal disruption later. 🎯𝐈𝐦𝐩𝐥𝐞𝐦𝐞𝐧𝐭 𝐇𝐲𝐛𝐫𝐢𝐝 𝐂𝐫𝐲𝐩𝐭𝐨𝐠𝐫𝐚𝐩𝐡𝐲: Do not wait for the full PQC rollout. 👉 𝐒𝐭𝐚𝐫𝐭 𝐮𝐬𝐢𝐧𝐠 𝐡𝐲𝐛𝐫𝐢𝐝 𝐞𝐧𝐜𝐫𝐲𝐩𝐭𝐢𝐨𝐧 𝐍𝐎𝐖! Combine classic schemes like ECDH or RSA with a post-quantum algorithm (e.g. a dual key exchange using ECDH + Kyber). 🎯𝐌𝐚𝐢𝐧𝐭𝐚𝐢𝐧 𝐚 𝐂𝐫𝐲𝐩𝐭𝐨𝐠𝐫𝐚𝐩𝐡𝐢𝐜 𝐁𝐢𝐥𝐥 𝐨𝐟 𝐌𝐚𝐭𝐞𝐫𝐢𝐚𝐥𝐬 (𝐂𝐁𝐎𝐌): 👉𝐈𝐧𝐯𝐞𝐧𝐭𝐨𝐫𝐲 𝐚𝐥𝐥 𝐜𝐫𝐲𝐩𝐭𝐨𝐠𝐫𝐚𝐩𝐡𝐢𝐜 𝐚𝐬𝐬𝐞𝐭𝐬 𝐢𝐧 𝐲𝐨𝐮𝐫 𝐨𝐫𝐠𝐚𝐧𝐢𝐳𝐚𝐭𝐢𝐨𝐧: algorithms, key lengths, libraries, certificates, and protocols. A CBOM provides visibility into where vulnerable algorithms (like RSA/ECC) are used and helps prioritize what to fix. 🎯🎯𝐀𝐥𝐢𝐠𝐧 𝐰𝐢𝐭𝐡 𝐍𝐈𝐒𝐓’𝐬 𝐐𝐮𝐚𝐧𝐭𝐮𝐦 𝐌𝐢𝐠𝐫𝐚𝐭𝐢𝐨𝐧 𝐑𝐨𝐚𝐝𝐦𝐚𝐩: Follow expert guidance for a structured transition. 𝐓𝐡𝐞 𝐔.𝐒. 𝐠𝐨𝐯𝐞𝐫𝐧𝐦𝐞𝐧𝐭 (𝐂𝐈𝐒𝐀, 𝐍𝐒𝐀, 𝐚𝐧𝐝 𝐍𝐈𝐒𝐓) 𝐚𝐝𝐯𝐢𝐬𝐞𝐬 𝐞𝐬𝐭𝐚𝐛𝐥𝐢𝐬𝐡𝐢𝐧𝐠 𝐚 𝐪𝐮𝐚𝐧𝐭𝐮𝐦-𝐫𝐞𝐚𝐝𝐢𝐧𝐞𝐬𝐬 𝐫𝐨𝐚𝐝𝐦𝐚𝐩, starting with a thorough cryptographic inventory and risk assessment. Keep abreast of NIST’s PQC standards timeline and recommendations.  National Institute of Standards and Technology (NIST) #𝐇𝐍𝐃𝐋 Cyber Security Forum Initiative #CSFI 🗝️ Now is the time to future-proof your encryption! 🗝️ 𝑌𝑜𝑢 𝑠ℎ𝑜𝑢𝑙𝑑𝑛'𝑡 𝑎𝑠𝑠𝑢𝑚𝑒 𝑡ℎ𝑎𝑡 𝑦𝑜𝑢𝑟 𝑑𝑎𝑡𝑎 𝑖𝑠 𝑠𝑒𝑐𝑢𝑟𝑒 𝑗𝑢𝑠𝑡 𝑏𝑒𝑐𝑎𝑢𝑠𝑒 𝑖𝑡 𝑖𝑠 𝑒𝑛𝑐𝑟𝑦𝑝𝑡𝑒𝑑...

Reading A Practitioner’s Guide to Post-Quantum Cryptography from the Cloud Security Alliance made me pause. It highlights something many organizations still underestimate very often: modern cryptography was not designed for a future with cryptographically relevant quantum computers (CRQCs). This threat is also not theoretical. The risk comes from Store Now, Decrypt Later attacks, where encrypted data can be harvested today and broken once quantum capabilities mature. Time, not just technology, becomes the critical risk factor. Key highlights from the guide • Shor’s and Grover’s quantum algorithms threaten most public-key cryptography in use today, including RSA, Diffie-Hellman, and elliptic-curve algorithms • CRQCs may emerge by the early 2030s, putting long-term-value data at risk even if systems are secure today • Data confidentiality and integrity are both impacted by Store Now, Decrypt Later attacks • NIST published post-quantum cryptography standards in 2024 (FIPS-203, FIPS-204, FIPS-205), but enterprise adoption will take time and investment • Risk assessment must begin by identifying which data assets still hold value at “Q-Day,” not by blanket cryptographic replacement Who should take note • Security leaders responsible for long-term data protection strategies • Architects managing encryption for data at rest, data in transit, and non-repudiation • Compliance and governance teams evaluating regulatory and sector-specific quantum readiness requirements • Engineering teams responsible for cryptographic libraries, TLS, VPNs, KMS, and certificate management Why this matters Unlike most cyber threats, quantum risk is driven by time. Data intercepted today may be compromised years later. If enterprises wait until CRQCs arrive, it will already be too late for data with long-term value. At the same time, mitigation is costly, complex, and not yet fully supported by mainstream products. The path forward The guide emphasizes starting with disciplined risk assessment, identifying vulnerable cryptographic functions, and mapping technology components before committing to mitigation. Enterprises should periodically reassess risk, track technology maturity, and align mitigation efforts with CSA Cloud Controls Matrix guidance rather than rushing into premature or unnecessary changes.

𝗪𝗵𝗶𝗹𝗲 𝘄𝗲'𝗿𝗲 𝗮𝗹𝗹 𝘁𝗮𝗹𝗸𝗶𝗻𝗴 𝗮𝗯𝗼𝘂𝘁 𝗔𝗜... Two research papers published last week put the quantum threat timeline closer than anyone planned for. Specifically, Google has set a 2029 target for migrating its systems to post-quantum cryptography, ahead of NIST's 2035 deadline. The prior industry assumption was ten years, minimum. Google and a startup called Oratomic published separate analyses pointing to a much shorter window. Cloudflare said publicly it was "very concerned" and still working through the findings. This isn't a defense contractor problem or a cryptocurrency problem. The encryption protecting your data in transit, your authentication systems, your stored credentials: it's built on RSA and elliptic curve. The same math these papers say is breakable. Post-quantum cryptography standards exist. NIST finalized them. Still, most organizations haven't even started migration planning. For most mid-market security programs, the fact is you don't know where all your cryptographic dependencies are. You haven't inventoried which systems rely on which algorithms. And "we'll deal with that when it's closer" got a lot less defensible last week. Crypto agility is what separates organizations that will handle this transition from ones that won't. Not a full migration right now, but rather the ability to swap algorithms without rebuilding your infrastructure from scratch. The first step is the inventory. Know what you're running. Nothing else matters until that work is done. https://lnkd.in/g7msPXBP

Most quantum boardroom conversations end without an agenda. They end with a posture — "we're monitoring quantum developments," "we're taking it seriously". Neither statement produces a plan. The distinction matters because quantum creates three problem classes, each with a different urgency and a different cost of inaction. A generic posture misaddresses all three at once. The right response, for most leadership teams, has three parts. The first is to defend now. Post-quantum cryptography belongs on the enterprise risk agenda as a current priority. That means building visibility into cryptographic dependencies across the enterprise, identifying migration priorities, and mapping third-party exposure. This is the part of the quantum agenda that cannot wait. The second is to explore selectively. Most leadership teams do not need a wide portfolio of quantum pilots. They need a small number of focused efforts on high-value problems where the workload aligns with quantum's actual strengths — evaluated against the strongest available classical alternative. Each effort should be a targeted test: one specific problem, one clear classical benchmark, one honest evaluation. The third is to build options. For companies in simulation-relevant sectors — pharmaceuticals, advanced materials, energy — the right posture is modest investment in partnerships and early hardware collaborations. The goal is R&D workflows that are ready to integrate quantum subroutines when the technology matures. The companies that benefit most will not necessarily be those spending the most today. They will be the ones best positioned to move when the moment arrives. The most common failure on quantum is conflating the urgency of the three classes — treating all three as equally distant or equally immediate, when each has a different clock running. The organizations that get this right understand early which problem classes matter to their business, which ones to set aside, and what the distinction demands of them starting Monday morning. https://lnkd.in/gkymW7Xm

🛡️ The Quantum Clock is Ticking quietly: Is Your Financial Infrastructure Ready? The financial industry is built on a foundation of digital trust, currently secured by #cryptographic standards like RSA and ECC. However, the rise of Cryptographically Relevant Quantum Computers (CRQC) poses an existential threat to this foundation. As we navigate this transition, here are 3 key pillars from the latest Mastercard R&D white paper that every financial leader must prioritize: 1. Addressing the 'Harvest Now, Decrypt Later' (HNDL) Threat 📥 Malicious actors are already intercepting and storing sensitive #encrypted data today, intending to decrypt it once powerful quantum computers are available. Financial Use Case: Protecting long-term assets such as credit histories, investment records, and loan documents. Unlike transient transaction data (which uses dynamic cryptograms), this "shelf-life" data requires immediate risk analysis and the adoption of quantum-safe encryption for back-end systems. 2. Quantum Resource Estimation & The 10-Year Horizon ⏳ While a CRQC capable of breaking RSA-2048 in hours might be 10 to 20 years away, the migration process itself will take years. Financial Use Case: Developing Agile Cryptography Plans. Financial institutions should set "action alarms" for instance, once a quantum computer reaches 10,000 qubits, a pre-prepared 10-year migration plan must be triggered to ensure infrastructure is updated before the "meteor strike" occurs. 3. Hybrid Implementations: The Bridge to Security 🌉 The transition won't happen overnight. The paper highlights the importance of Hybrid Key Encapsulation Mechanisms (KEM), which combine classical security with PQC. Financial Use Case: Enhancing TLS 1.3 and OpenSSL 3.5 protocols. By implementing hybrid models now, banks can protect against current quantum threats (like HNDL) while maintaining compatibility with existing classical systems, ensuring a smooth and safe transition. The Bottom Line: A reactive approach is no longer an option. Early adopters who evaluate their data's "time value" and begin the migration today will be the ones to maintain resilience and protect global financial assets tomorrow. #QuantumComputing #PostQuantumCryptography #FinTech #CyberSecurity #DigitalTrust #MastercardResearch