There is a lot of noise around post-quantum cryptography, or PQC; and with noise comes confusion. Confusion often leads enterprises to either panic prematurely or procrastinate dangerously. So, let’s get one thing straight: the risk is real. But the way we talk about it – and more importantly, the way we act on it – needs a course correction.
The risk is real, but it’s not uniform
Yes, state-driven attackers are already harvesting encrypted traffic in bulk in what is known as harvest now, decrypt later (HNDL) tactics. The objective is simple: crack it open later, once quantum computing can break today’s public-key cryptography. This is not science fiction; it’s espionage in slow motion. But that doesn’t mean every encrypted packet you send today is a ticking time bomb.
We need to ask a basic question: will the data still matter by the time it is decrypted?
For most transient data, such as web traffic, session tokens, or authentication credentials, the risk from future decryption is minimal. These artefacts are typically short-lived. Even if a state-driven actor captures and decrypts them years from now, they are likely to have already expired. Their value is time-bound – or it should be.
If that’s not true – if an environment allows static credentials, long-lived sessions, or unmanaged tokens – then it has already lost the security battle, regardless of the algorithm in play. That is not a cryptographic failure; it’s a procedural failure. The root cause is operational, not mathematical. The remedy is rotation, expiry enforcement, and access discipline. These are hygiene issues, not quantum ones.
On the other hand, data at rest is different. Intellectual property, financial transactions, legal documents, and sensitive healthcare records can retain value for years. That’s what makes them a prime target for harvest-now, decrypt-later operations. This is where the post-quantum conversation needs to be anchored.
Visibility first, always
Before any migration to PQ-safe algorithms begins, enterprises must gain clear visibility. The ability to detect and assess quantum-unsafe cryptography across the network provides what many organizations currently lack: real-time, asset-level insight.
You cannot govern what you cannot see. And you cannot prioritise without context. For instance, a TLS 1.2 handshake using RSA-2048 might look dangerous, but if it’s protecting short-lived traffic in a hardened enclave, it’s a red herring. Conversely, an outdated FTP server quietly archiving merger documents is a strategic liability.
That context – knowing where cryptographic risk resides and what it protects – is everything. Scanning for unsafe algorithms is not about panic; it is about mapping your exposure with clarity. This is where the security conversation must mature. Detection reveals risk. Governance owns it. Without process discipline, crypto hygiene, and lifecycle control, visibility becomes just another dashboard. With them, it becomes a force multiplier.
Recent Forescout research paints a picture of just how uneven that visibility still is.
Support for post-quantum cryptography in SSH servers, for example, is growing but slowly. Only 8.5% of all SSH servers currently support PQC, rising to 26% among OpenSSH deployments. TLS 1.3 adoption, which enables PQC, has stagnated at 19%, while reliance on TLS 1.2 (which does not support PQC) has actually increased from 43% to 46%.
This signals that unmanaged and legacy devices are being left behind. IoT, OT, IoMT, and network equipment lag significantly behind traditional IT assets in PQC adoption. The result is a fragmented cryptographic landscape and a growing visibility gap between managed and unmanaged assets.
Contextual risk management beats cryptographic panic
Let’s not pretend that PQC is a silver bullet, and let’s not pretend adopting it is trivial. The transition will be long, complex, and filled with false starts. It will demand crypto agility, disciplined key lifecycle management, and architectural flexibility. That means updating libraries, enabling algorithm negotiation, auditing dependencies, and preparing systems to swap cryptographic modules as standards evolve.
But technology alone won’t solve this. Most enterprise risk still stems from poor inventory, stale secrets, and lack of cryptographic accountability. That is a governance issue, not a maths problem.
Industry data shows how uneven the journey already is. Sectors dominated by unmanaged or embedded devices – for example, manufacturing, oil and gas, and mining – show the lowest PQC adoption rates. In contrast, professional and business services are leading the way. The takeaway is clear: PQC migration is not a technology race; it’s an asset management challenge.
A pragmatic strategy includes:
- Classify data by longevity and sensitivity: if it won’t matter in 12 months, you’re fine. If it will matter in 12 years, you are not.
- Audit where and how that data is stored: don’t limit yourself to the cloud. Look in backups, archives, endpoint storage, and shadow IT.
- Instrument your infrastructure: use a trusted solution to detect legacy cryptography, flag downgrade risks, and map exposure across your environment.
- Design for agility: build key rotation and algorithm swapping into your newly deployed cryptographic frameworks from day one.
- Embed governance: document key ownership, set expiry dates for encryption, use envelope encryption where appropriate, and educate teams on what ‘quantum-safe’ actually means.
Quantum-safe does not mean quantum-proof; it means ‘resistant to known attack vectors as best understood today.’ That definition will evolve. The crypto stack must be able to evolve with it.
The real value of detection
There is a critical shift happening in enterprise cybersecurity. We are moving from static, compliance-based control models to dynamic, contextual risk awareness. Visibility is less about box-ticking and more about enabling the right decisions. Knowing where weak cryptography resides tells you where outdated policies live. Knowing what cryptography protects tells you what is truly at risk.
Detection, in this case, is diagnostic. It reveals how much control there really is. If you don’t know which algorithms are running in your environment, you’re not managing encryption; you’re assuming it.
The ability to map unsafe cryptographic usage across IT, OT, and IoT gives security leaders a baseline they can act on – not only for monitoring but for planning, prioritising, and building the roadmap to quantum readiness. That is what separates visibility from actionable intelligence.
Fix what matters first
Security leaders have seen this movie before. We’ve lived through the rush to zero trust, the buzz around blockchain, and the noise about AI in cybersecurity. In some cases, we’ve even lived through Y2K compliance! Each time, there has been a need to cut through the buzz and focus on what actually moves the needle. Post-quantum is no different; the stakes may be higher, but the principle is the same.
Success doesn’t start with algorithms. It starts with assets, with process, with context. Ask the right questions: what data matters, who can access it, how is it protected, how often are protections renewed, who is accountable?
If you can answer those, you’re already ahead. If you can’t, your first step isn’t post-quantum migration – it’s regaining control of what you already have.
Start by educating your teams on NIST’s ‘Migration to PQC’ guidelines, which map directly to CSF 2.0 and NIST SP 800-53. Build and maintain an inventory of assets that do or do not support PQC, and correlate that with contextual data about sensitivity and exposure.
The path to resilience begins with awareness and ends with disciplined execution. Quantum may be the catalyst, but resilience will come from visibility, governance, and disciplined execution.
The author
Rik Ferguson is VP Security Intelligence, Forescout
