Quantum-safe cryptography is becoming a CISO planning issue

At a glance

What this is: This is a CISO-focused analysis of why quantum-safe cryptography now affects the durability of current encryption, certificates, and key management decisions.

Why it matters: It matters because IAM, PKI, and machine identity programmes depend on cryptography that will outlive today’s algorithms, so planning now reduces future exposure and migration shock.

By the numbers:

• The Global Risk Institute estimates that quantum computers capable of breaking RSA-2048 are likely to exist in the coming years.

Context

Quantum-safe cryptography is the problem of keeping encrypted data, certificates, and digital trust usable after current public-key methods can no longer be relied on. In practice, the issue is not a future lab experiment but a migration problem already shaping planning for identities, workloads, and long-lived data.

For identity and access management teams, the cryptographic layer is part of the control plane, not an implementation detail. If certificates, VPNs, signing keys, and federated trust depend on algorithms that will age out, then the programme has a lifecycle issue as much as a security issue.

Key questions

Q: How should teams prioritise data for post-quantum cryptography migration?

A: Prioritise data by confidentiality lifetime, replaceability, and exposure spread. The most urgent datasets are those that remain harmful if disclosed for years, cannot be reissued easily, and already exist in multiple copies across backups, analytics, email, and cloud services. That gives you a practical queue for migration and compensating controls.

Q: Why does quantum risk matter before quantum computers can actually break RSA?

A: Quantum risk matters early because attackers can record encrypted traffic today and decrypt it later once enough quantum capability exists. That makes long term secrets vulnerable long before Q-Day arrives. Organisations that protect sensitive data with long retention periods should treat confidentiality as a current planning problem, not a distant theoretical one, because exposure can happen retroactively after interception.

Q: When should organisations prioritise post-quantum migration work over waiting for final standards?

A: Organisations should begin planning now, even before every standard detail is final, because migration across certificates, validation software, and application ecosystems can take years. Waiting creates a larger backlog once production deadlines tighten. The sensible sequence is inventory, lab testing, and dependency mapping first, then staged rollout as standards and interoperability guidance stabilise.

Q: What is the difference between hybrid post-quantum cryptography and a full cryptographic replacement strategy?

A: Hybrid post-quantum cryptography combines a classical algorithm with a quantum-resistant one so systems can preserve compatibility while gaining forward security. A full replacement strategy removes the classical algorithm entirely and depends only on the newer scheme. Hybrid approaches are usually easier to deploy first, while full replacement demands broader ecosystem readiness and stronger assurance.

Technical breakdown

Why RSA and ECC become brittle under quantum attack

RSA and elliptic-curve cryptography rely on mathematical problems that are hard for classical computers but vulnerable to Shor’s algorithm on a sufficiently capable quantum machine. That does not mean every encrypted system fails tomorrow. It does mean the trust horizon changes, especially for data, signatures, and certificates that need to remain valid or confidential for years. The real governance problem is that cryptographic strength is not static. A control that is acceptable today may become structurally insufficient within the lifetime of the protected data. Read Post-Quantum Readiness for Identity and PKI.

Practical implication: Map every business process that depends on long-lived signatures or confidentiality to the algorithms protecting it.

How hybrid encryption reduces migration risk

Hybrid encryption combines classical and post-quantum algorithms so systems can keep operating while new cryptographic methods are introduced. This is a transition pattern, not an end state. It is especially useful where partners, platforms, or hardware cannot all move at once. The architectural challenge is compatibility, because larger keys and different performance characteristics can affect storage, bandwidth, and application behaviour. Organisations need to test these effects before they depend on them at scale.

Practical implication: Pilot hybrid modes in systems with real interoperability pressure before extending them across critical trust paths.

Why cryptographic inventory is the first control

A cryptographic inventory identifies where vulnerable algorithms, keys, certificates, and trust dependencies exist across systems, applications, and data stores. Without that inventory, quantum migration becomes guesswork. The inventory also needs context, including data lifespan, certificate purpose, and external dependencies, because not every asset has the same exposure window. For identity programmes, this is where machine credentials, signing chains, and federation dependencies should be surfaced explicitly. The central failure mode is hidden crypto debt: protection that looks complete until you ask what algorithms are actually in use.

Practical implication: Build a complete crypto inventory before prioritising replacement schedules or vendor dependency reviews.

Threat narrative

Attacker objective: The attacker’s objective is to preserve encrypted material now and decrypt or impersonate it later, once quantum capability makes current public-key protection unreliable.

1. Entry occurs when adversaries intercept encrypted traffic or store protected data today, even though they do not yet have quantum capability.
2. Credential and key material remain exploitable later because RSA and ECC protections are expected to weaken once quantum hardware matures.
3. The escalation step is deferred decryption, where previously captured data, signatures, or certificates are exposed after the cryptographic break becomes practical.
4. Impact is long-tail compromise of sensitive information that was assumed to remain confidential for years.

Breaches seen in the wild

• reviewdog Action compromise 2025: A stolen maintainer token poisoned reviewdog/action-setup, leaking CI secrets including the tj-actions bot token used in the next attack.
• SpotBugs token leak 2025: A SpotBugs maintainer's PAT, stolen via a pull_request_target workflow in 2024, started the reviewdog and tj-actions supply chain attack.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Crypto agility is now an identity governance problem, not just a cryptography problem. Certificates, trust chains, and federated authentication depend on algorithms that sit underneath IAM and machine identity programmes. When those algorithms age out, the issue becomes lifecycle control over trust itself, not a simple cipher swap. Practitioners should treat crypto inventory as part of identity governance and not as a back-end hygiene task.

Harvest-now, decrypt-later changes the risk model for long-lived data. The exposure is created at capture time, but the damage lands years later when decryption becomes feasible. That means confidentiality decisions must be made against the lifespan of the data, not the lifespan of the current algorithm. Organisations that ignore retention horizon are already assuming away their own future exposure.

Post-quantum migration debt: the gap between where cryptography runs today and where it must be when quantum risk matures. That debt accumulates when inventory is incomplete, testing is deferred, and third-party dependencies are left outside the migration plan. The practical conclusion is that migration sequencing belongs in security governance now, before dependency sprawl makes the change more expensive.

Third-party cryptographic dependence is the hidden blocker in many migration programmes. Cloud providers, software vendors, and hardware suppliers will not move in lockstep, so the effective control boundary extends beyond the organisation. That makes supplier assurance and dependency mapping part of quantum readiness, especially where certificates, signing services, or embedded trust anchors are externalised. Practitioners should assume the slowest dependency defines the migration pace.

The most dangerous assumption is that long timelines equal low urgency. Quantum readiness is a multi-year programme precisely because the eventual change affects foundational trust services. Waiting for a crisp external deadline leaves no room for testing, compatibility work, or staged rollout. Teams should start now because the operating model, not the mathematics, is what takes the longest to change.

From our research library:

• Software supply chain attacks were projected to cost organisations $60 billion in 2025.
• Read next: CI/CD Pipeline Identity Security Guide

What this signals

Post-quantum migration debt: the delay between recognising quantum risk and completing the inventory, testing, and dependency work needed to change trust infrastructure safely. That debt grows fastest where cryptographic ownership is fragmented across identity, application, and supplier teams, so security leaders should treat migration sequencing as a governance issue.

Fortanix’s framing reflects a broader reality for IAM and PKI teams: cryptographic trust is becoming a lifecycle problem, not a static configuration issue. The organisations that prepare early will absorb the change through controlled refresh cycles, while late movers will face compressed timelines, partner dependency surprises, and avoidable rework.

For practitioners

• Build a cryptographic inventory across all trust dependencies Catalogue where RSA, ECC, certificates, signing services, and key management live across applications, data stores, and infrastructure. Include data lifespan and partner dependencies so you can rank migration by exposure window rather than by system visibility alone. Read Post-Quantum Readiness for Identity and PKI.
• Test hybrid post-quantum modes in controlled environments Run interoperability and performance tests before making any broad change to production trust paths. Focus on systems where bandwidth, storage, signing latency, or partner compatibility could break under larger keys or different algorithm behaviour.
• Prioritise long-lived data and signatures first Move the most sensitive and longest-retained data ahead of short-lived operational traffic. The highest-priority assets are the ones that must remain confidential or verifiable for years, not necessarily the ones with the highest current volume.
• Map third-party crypto dependencies into the migration plan Ask cloud, software, and hardware providers which cryptographic functions they control, which algorithms they support, and how quickly they can change. Vendor assurance matters because your trust chain is only as ready as its slowest external dependency. See the SaaS-to-SaaS and OAuth App Governance Guide.

Key takeaways

• Quantum-safe planning is about preserving trust in data, signatures, and certificates that must remain valid beyond the life of today’s algorithms.
• The main evidence is the growing plausibility of quantum attacks against RSA-2048, which makes harvest-now, decrypt-later a present governance concern.
• The strongest control response is to inventory cryptography first, then phase migration with hybrid testing and supplier dependency mapping.

Related NHI Mgmt Group resources: Post-Quantum Readiness for Identity and PKI · CI/CD Pipeline Identity Security Guide · SaaS-to-SaaS and OAuth App Governance Guide

Key terms

• Quantum-safe encryption: Quantum-safe encryption refers to cryptographic methods designed to remain resistant to future quantum attacks. It protects data confidentiality, but it does not manage who can access systems, elevate privilege, or operate administrative functions, so it must be governed alongside identity and access controls.
• Harvest now, decrypt later: An attacker strategy where encrypted traffic or stored data is collected today and decrypted later when better computing power becomes available. It matters to NHI governance because machine identities often protect the data paths and secrets most worth preserving over time.
• Crypto-Agility: Crypto-agility is the ability to change cryptographic algorithms, certificates, and trust dependencies without redesigning production systems. It matters because cryptographic standards evolve, and organisations need accurate inventories and automated lifecycle controls before they can migrate safely.
• Cryptographic Inventory: A cryptographic inventory is a continuously updated record of keys, certificates, algorithms, libraries and trust anchors across an organisation. It is not a spreadsheet or one-time audit output. In practice, it links each asset to ownership, usage, lifecycle state and risk so teams can make remediation decisions.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management in the context of real-world access control decisions. It gives practitioners a common framework for applying identity discipline to modern security programmes that depend on trust, credentials, and lifecycle control.