Manufacturing PQC: are your firmware trust controls ready?

TL;DR: Post-quantum cryptography in manufacturing is less about “harvest now, decrypt later” and more about preserving authenticity in secure boot, firmware signatures, and machine certificates as PLCs and SCADA assets remain in service for decades, according to Forescout. That makes crypto-agility and supplier upgrade paths a governance issue, not a purely technical one.

Editorial analysis by NHI Mgmt Group, based on content published by Forescout: “PQC in Manufacturing: 11 Must-Ask Questions Before You Upgrade”.

Key questions

Q: What breaks in manufacturing when firmware trust cannot move to post-quantum cryptography

A: The failure is not just weaker encryption.

Q: Why do long-lived PLCs make post-quantum migration harder than normal crypto upgrades

A: Because the asset lifetime, safety approvals, and supplier support windows are all longer than the lifecycle of current cryptographic assumptions.

Q: How do teams know whether crypto-agility is actually working?

A: Crypto-agility is working when algorithms can be changed without major re-engineering and the inventory shows which systems will be affected before the change is made.

Practitioner guidance

• Inventory firmware trust chains Document which controllers, gateways, and engineering tools rely on each signing key, certificate authority, and trust anchor.
• Test trust-anchor update paths Verify whether installed devices can accept new trust anchors, signature algorithms, and verifier software without replacement.
• Map supplier upgrade commitments Ask vendors for the exact release that supports PQC, the maintenance window required, and the support period after deployment.

Bottom line: Manufacturing PQC risk is dominated by the integrity of firmware signing, secure boot, and machine certificates, not only by encrypted traffic.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →