Topic starter
25/06/2026 12:00 am
TL;DR: Quantum computing threatens current public key cryptography, and attackers can already preserve encrypted data for future decryption, according to SSH Communications Security. Long-lived systems, unmanaged keys, and slow migration cycles make cryptographic inventory and prioritisation an identity and access problem, not just a standards exercise.
Editorial analysis by NHI Mgmt Group, based on content published by SSH Communications Security: “Protecting Critical Infrastructure Against the Quantum Threat. Why you need to plan for Post-Quantum Cryptography (PQC) now”.
Key questions
A: Without a complete inventory, teams miss certificates and keys hidden in TLS endpoints, code-signing, VPNs, databases, embedded devices, and third-party integrations.
Q: Why does harvest now, decrypt later risk make post-quantum planning urgent for long retention data?
A: Harvest now, decrypt later creates risk because encrypted data stolen today may remain valuable for years, especially in sectors that retain records for decades.
Q: Where do post-quantum migration programmes fail most often in OT environments?
A: They fail where long equipment lifecycles, limited maintenance windows, and legacy certificate trust chains make change slow.
Practitioner guidance
- Map cryptographic assets across the estate Catalogue certificates, public key algorithms, SSH keys, host keys, and any unmanaged key material so migration scope is visible before planning starts.
- Prioritise long-retention data and systems Rank the environments whose confidentiality must last for years or decades, including regulated archives, engineering data, and OT records, because these are most exposed to harvest-now, decrypt-later risk.
- Inventory OT cryptographic dependencies early Identify firmware validation, device authentication, and session setup flows in critical infrastructure before maintenance windows force rushed decisions.
Bottom line: Quantum risk is no longer a distant standards issue, because encrypted data can be harvested now and exposed later.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 8:48 am
Cryptographic inventory has become an identity governance control, not a background hygiene task. The article is right to frame visibility as the first prerequisite because identity and access systems are full of certificate trust, key exchange, and signed assertion dependencies. Without a complete inventory, migration planning is guesswork and risk prioritisation is arbitrary. Practitioners should treat unknown cryptographic dependencies as governance debt, not as a future optimisation problem.
A question worth separating out:
Q: How should security teams start a post-quantum migration program?
A: Start by inventorying where cryptography is actually used, then measure external exposure first. Public domains, certificates, SSH keys, and service accounts should be mapped to owners and replacement paths before standards deadlines force a rushed program. A quick scan is useful, but the real work is governance, sequencing, and lifecycle control.
👉 Read our full editorial: Quantum-safe migration starts with cryptographic inventory and risk