Notifications
Clear all
Topic starter
08/06/2026 4:36 pm
TL;DR: Governments are urging a shift to post-quantum cryptography, but the real prerequisite is cryptographic agility, the ability to swap algorithms with minimal disruption as standards, performance trade-offs, and regulatory requirements change, according to Keyfactor. The security case is now inseparable from identity governance, because cryptographic change touches certificates, workloads, and machine trust relationships.
NHIMG editorial — based on content published by Keyfactor: Preparing for Quantum Threats and the Importance of Cryptographic Agility
By the numbers:
- Organisations that describe themselves as confident in their AI deployment actually experience a 72% security incident rate, compared to 33% for those who remain cautious.
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems.
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job.
Questions worth separating out
Q: How should security teams prepare for post-quantum cryptography migration?
A: Start by inventorying where cryptography is embedded in identity, certificate, and workload trust flows, then classify which systems can change algorithms by policy and which require code or hardware changes.
Q: Why does cryptographic agility matter for IAM and NHI programmes?
A: Because identity systems depend on certificates, keys, and trust anchors that often outlive the algorithms they were built around.
Q: What breaks when cryptographic algorithms are hardcoded into production systems?
A: Hardcoded algorithms make algorithm replacement slow, risky, and expensive.
Practitioner guidance
- Inventory cryptographic dependencies across identity services Catalogue every place certificates, keys, signing algorithms, and trust anchors are used in authentication, workload identity, and service-to-service trust.
- Classify systems by crypto replacement difficulty Separate platforms that can change algorithms through policy from those that require application rewrites, firmware updates, or vendor intervention.
- Build a staged PQC testing path Run parallel validation for candidate post-quantum algorithms in non-production environments, including performance, interoperability, and certificate size impact.
What's in the full article
Keyfactor's full blog covers the operational detail this post intentionally leaves for the source:
- Algorithm trade-off discussion across key size, signature size, and compute overhead for PQC candidates
- Regional cryptographic preference differences across countries and the product flexibility needed to satisfy them
- Performance and interoperability considerations for shipping one crypto-agile product across multiple markets
- Engineering rationale for why cryptographic agility reduces redesign effort when standards change
👉 Read Keyfactor's post on preparing for post-quantum cryptographic agility →
Cryptographic agility and PQC migration: is your control plane ready?
Explore further
08/06/2026 6:19 pm
Cryptographic agility is an identity governance problem, not just a cryptography problem. Certificates, keys, and trust anchors are part of the machine identity control plane, so algorithm change becomes a lifecycle issue the moment systems rely on those assets in production. The industry still tends to treat crypto refresh as an engineering task, but the operational reality is entitlement, dependency, and offboarding complexity. Practitioners should treat cryptographic change as governed identity change, not a one-off technical swap.
A few things that frame the scale:
- Organisations that describe themselves as confident in their AI deployment actually experience a 72% security incident rate, compared to 33% for those who remain cautious, according to The 2026 Infrastructure Identity Survey.
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption.
A question worth separating out:
Q: How do organisations know whether their cryptographic estate is truly agile?
A: A crypto-agile estate can change algorithms, certificate profiles, or trust policies without major application redesign, extended downtime, or emergency vendor intervention. If replacement requires rebuilding systems, replacing hardware, or freezing changes for months, agility is not actually in place.
👉 Read our full editorial: Cryptographic agility is the missing control for post-quantum migration
