Matthew RosenquistFounder & CISO Advisor, Cybersecurity Insights · CISO, Cybersecurity Strategist, & Industry Advisor

Importance of Timing and Implementation of Post Quantum Cryptography

19 Aug 2025 · 2 min

Watch on YouTube

2:00

In this monologue, the speaker argues that organizations must act immediately on post‑quantum cryptography (PQC). The first step is a comprehensive inventory of an organization’s data footprint to pinpoint where PQC should be applied. Because early internal conversations often lack key stakeholder engagement, the speaker stresses the need for strong internal advocacy to cut through hype, present realistic threat scenarios, and secure executive buy‑in. The discussion highlights the “harvest‑now‑decrypt‑later” threat model, recent news about attacks on certificate authorities, and a revised timeline that shrinks the quantum risk horizon from two decades to roughly five to ten years. The speaker notes that NIST provides concrete guidance on PQC adoption and stresses the importance of crypto‑agility to integrate well‑defined algorithms into products. Finally, a caution is issued about generative AI systems such as Stride, warning that quantum‑related vulnerabilities could be amplified if organizations neglect these protections.

Chapters

the time is now. And I think people should start to gear up, take inventory of their data footprint, understand and make sure that they can see all of the data across, and then determine where they should apply PQC. I think that's a really important first step. The other thing that I think is super important in a topic like this is even early on when we used to have these conversations internally, there wasn't a lot of key stakeholders that really wanted to pursue these types of things. So it's really important to be a good internal advocate, kind of cut through the hype, provide like the ground truth of the scenarios that we're in, where data is affected or is not affected, and really have like executive buy-in on these types of things. Because although we talk about harvest now, decrypt later, there's other threat vectors. And I'm sure if you've been watching the news last couple of weeks, people are talking about crypto and, you know, all these other scenarios with certificate authorities You know, these are real threats and, you know, it's a looming threat and there's so much uncertainty on how fast this is going to accelerate because, you know, not too many months ago people were saying this is 20 years out and now people have revised this to be, you know, the next 5 or 10 years. You know, I think people are finally having the right conversations, but, you know, internally, whether you're a customer or a vendor, you should really be having these internal conversations, have some executive buy-in. And then, you know, proceed with what is known. And, you know, we're all blessed that NIST is really giving us a lot of good guidance on where to apply these things, how we can get this into the product, and talking about crypto agility. So, you know, it's not everyone's discovering uncharted land. Some of these things are relatively well-defined, and people should be adapting and adopting to that. And, you know, I would say the other component to that is if quantum does hit a Gen AI like Stride, people better be really careful on sleeping on this type of technology to protect themselves.