FEATURE
The question isn’ t when quantum computers will be powerful enough, it’ s how long your data needs to remain secret.
That matters particularly in Australia and New Zealand because so much of the technology we consume is developed elsewhere. Cloud platforms, SaaS applications, operating systems, security products, hardware and certificate authorities all have their own technology roadmaps. The uncomfortable reality is that your PQC migration timeline may not actually be yours. It may belong to your cloud provider, software vendor, hardware supplier or another part of your technology supply chain. Start with the question most organisations struggle to answer: where exactly are you using cryptography today?
The answer is rarely straightforward. Cryptography is everywhere, in certificates, APIs, VPNs, applications, databases, identity systems, firmware, devices and infrastructure accumulated over many years. Before organisations start talking about replacing algorithms, they need to understand what they actually have and what breaks if we change the cryptography.
PQC is a migration. Crypto agility is the capability
Becoming quantum-safe matters, but if all we do is replace today’ s algorithms with new algorithms, we will miss a much bigger opportunity. We need to use this transition to build crypto agility, which does not simply mean supporting multiple algorithms.
The real test is how quickly and safely we can change cryptography across a critical business service without redesigning or disrupting that service. That takes visibility, clear policy, automation to make changes at scale and the ability to roll back changes safely.
Architecture matters
If cryptographic decisions are hard coded independently into thousands of applications, every future transition becomes hundreds or thousands of migration projects. That isn’ t
26
INTELLIGENT CIO APAC www. intelligentcio. com