Topic starter
23/10/2026 12:47 am
TL;DR: Post-quantum cryptography planning depends less on abstract quantum timelines than on knowing which algorithms, certificates, and negotiated connections are actually in use, according to Corelight, because passive network visibility can reveal downgrades that inventories miss. The practical shift is from assumed crypto posture to evidence-based cryptographic inventory and migration prioritisation.
Editorial analysis by NHI Mgmt Group, based on content published by Corelight: “Cryptography is negotiated, not configured: Why PQC readiness needs network data”.
By the numbers:
- 65% of human-to-Cloudflare traffic is already using some sort of hybrid or PQC-capable encryption.
Key questions
Q: How should security teams start a post-quantum migration program?
A: Start by inventorying where cryptography is actually used, then measure external exposure first.
A: Because encrypted data can be captured today and stored until future quantum capabilities make decryption feasible.
Q: What breaks when cryptographic posture is assumed instead of observed?
A: You can believe a system is protected by PQC-capable controls while the live connection quietly falls back to classical algorithms.
Practitioner guidance
- Build a cryptographic bill of materials Map algorithms, key lengths, certificates, libraries, endpoints, and dependent services into a single inventory that can support migration planning.
- Verify negotiated algorithms from live traffic Use passive network visibility to confirm what cipher suites and key exchanges are actually used, not just what systems claim to support.
- Prioritise long-lived data and credentials Rank systems by how long the protected data or credential state must remain confidential, then move the longest-horizon assets first.
Bottom line: Post-quantum migration fails when teams treat configuration support as proof of real-world cryptographic posture.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →