Post-quantum security starts with finding where encryption is used

Preparing for future quantum threats is partly an inventory problem. Before an organisation can replace vulnerable cryptographic methods, it needs to know where those methods appear in software, devices, certificates and long-lived data systems.

NIST released its first three finalised post-quantum cryptography standards in 2024. These provide new building blocks for protecting information against attacks that sufficiently capable quantum computers could make possible. They do not mean that every existing system can switch algorithms without further engineering.

Encryption and digital signatures sit inside many layers of a service. A change may affect message sizes, processing costs, compatibility and the way products communicate. Older equipment can be particularly difficult to update. Testing must therefore include the whole workflow rather than only an isolated algorithm.

A practical migration plan identifies sensitive information, checks supplier road maps and creates room for future cryptographic changes. Long retention periods deserve attention because information collected today may remain valuable for years. The immediate task is organised preparation: understanding dependencies and evaluating replacements before urgency makes a complex transition harder to manage.