Matthew RosenquistFounder & CISO Advisor, Cybersecurity Insights · CISO, Cybersecurity Strategist, & Industry Advisor

Importance of Timing and Implementation of Post Quantum Cryptography

19 Aug 2025 · 2 min

Watch on YouTube

1:59

In this commentary, Matthew Rosenquist urges organizations to act now on post‑quantum cryptography (PQC). He outlines a practical roadmap: first inventory the organization’s data footprint and identify where PQC should be applied; then become an internal champion to cut through hype, present realistic threat scenarios, and secure executive buy‑in. He highlights real‑world threat vectors such as “harvest‑now‑decrypt‑later” attacks and emerging certificate‑authority vulnerabilities, noting that the perceived timeline for quantum‑enabled attacks has shifted from decades to the next 5‑10 years. Rosenquist points to NIST’s evolving guidance, emphasizing crypto‑agility and the availability of well‑defined implementation pathways, while warning that a rapid quantum breakthrough—especially if coupled with generative AI advances—could leave unprepared entities exposed.

Chapters

the time is now. And I think people should start to gear up, take inventory of their data footprint, understand and make sure that they can see all of the data across, and then determine where they should apply PQC. I think that's a really important first step. The other thing that I think is super important in a topic like this is even, even early on when we used to have these conversations internally, there wasn't a lot of key stakeholders that really wanted to pursue these types of things. So it's really important to be a good internal advocate. I'll kind of cut through the hype, provide like the ground truth of the scenarios that we're in, uh, where data is affected or it is not affected, and really have like executive buy-in on these types of things. Because although we talk about harvest now, decrypt later, there's other threat vectors. And I'm sure if you've been watching the news last couple weeks, people are talking about crypto and, you know, all these other scenarios with certificate authorities. So You know, these are real threats and, you know, it's a looming threat and there's so much uncertainty on how fast this is going to accelerate because, you know, not too many months ago people were saying this is 20 years out and now people have revised this to be, you know, the next 5 or 10 years. So, you know, I think people are finally having the right conversations, but, you know, internally, whether you're a customer or a vendor, you should really be having these internal conversations, have some executive buy-in. And then proceed with what is known. And we're all blessed that NIST is really giving us a lot of good guidance on where to apply these things, how we can get this into the product, and talking about crypto agility. So it's not everyone's discovering uncharted land. Some of these things are relatively well-defined and people should be adapting and adopting to that. And, you know, I would say the other component to that is if quantum does hit a GenAI-like stride, people better be really careful on sleeping on this type of technology to protect themselves.