AI is keeping security teams busy, from increasingly convincing scams to questions over what autonomous agents can access and do. But businesses also need to be making time for quantum security.
Nobody knows exactly when a quantum computer will be able to break widely used encryption. Preparing for that possibility could take years, though, and some of the information businesses protect today will still be sensitive long after that point.
For Cybersecurity Awareness Month, experts from DigiCert, F5 and Arqit look at the progress being made, the gaps that remain and where businesses should focus their efforts to plug them.
Know where cryptography is used
Organisations are having to renew digital certificates more often while working out how to replace cryptography that could be vulnerable to quantum attacks. Paul Holt, Group Vice President, EMEA at DigiCert, says CISOs are having to tackle several challenges at once: “AI agents are taking on business tasks faster than many organisations can establish oversight. Public TLS certificate lifespans are shrinking toward a 47-day maximum by 2029, making manual management increasingly difficult. And with post-quantum cryptography standards in place, organisations need a plan to replace cryptography that future quantum attacks could break.”
While these developments present different challenges, they share a common requirement in that organisations need greater visibility and control over the systems and identities they depend on.
For Holt, that starts with understanding where cryptography is used and who has control over it. He says, “CISOs need to know where certificates and cryptographic algorithms are used, which AI agents can act on the organisation’s behalf and who controls them. They also need to be able to renew certificates, replace algorithms, or revoke an agent’s authority when circumstances change.”
A protected website is only the start
Research from F5 Labs suggests post-quantum protection is becoming more widespread across the web. But David Warburton, Director at F5 Labs, warns that the headline figures only tell part of the story: “On the face of it, the web is making real progress on post-quantum security. Our latest research found that 54% of the world’s top one million websites now support a post-quantum key exchange. But the devil is in the detail, because much of that protection has been switched on by content delivery networks on behalf of their customers. Exclude Cloudflare-hosted sites from the sample and adoption falls to 22%.”
A website may have that protection while the systems behind it remain exposed, Warburton explains: “It helps protect traffic between a visitor and a website from being captured today and decrypted in the future. What it cannot tell us is whether the connections behind that website have been upgraded too. An organisation might have post-quantum protection at its public edge while its internal applications, APIs and connections to partners continue to use older cryptography.”
Businesses should not wait for a firm date for Q-Day before getting started, he adds: “Nobody can put a reliable date on when a quantum computer will be able to break today’s encryption. But organisations don’t need that date to start preparing. The sensible first step is to identify where they use cryptography, particularly where sensitive information needs to remain confidential for years. They can then work out which systems and suppliers will take longest to update and plan accordingly.”
Making cryptography easier to update
Jonathan Nguyen-Duy, Chief Technology Officer at Arqit, says businesses have been given warning of the quantum threat and need to use that time wisely: “Unlike other potential cyber risks, this is a threat that we know is coming, so organisations cannot simply assume that it won’t happen and hope for the best”.
Preparing also means looking beyond the first round of upgrades. Nguyen-Duy says businesses need to keep testing whether their security is still fit for purpose, he advises “Businesses must ensure they are resilient enough to deal with these evolving threats, by regularly questioning whether the security assumptions the business relies on still hold true, including the cryptography underpinning trust in its data and systems. True agility, and therefore resilience, means building infrastructure that can adapt before today’s protections become tomorrow’s weaknesses.”
Getting started before time runs short
Waiting for certainty over Q-Day leaves businesses with less – and potentially not enough – time to prepare. Mapping where cryptography is used, identifying information that needs protection for years and understanding which systems will be hardest to update gives them somewhere practical to start.
That work also needs to make future updates easier. Businesses will need to revisit their cryptography as standards change and new threats emerge. Building that ability into their systems now should make the next transition less disruptive.
