Quantum Security Is About More Than Encryption

When organizations begin preparing for the Quantum Era, the conversation usually starts in the same place: encryption.

And for good reason, much of the digital world depends on cryptographic systems built around mathematical problems that are extremely difficult for today’s computers to solve. A Cryptographically Relevant Quantum Computer, a quantum computer powerful enough to break widely used public-key cryptography, could fundamentally change that assumption.

For roughly a decade, researchers have been working to identify and standardize cryptographic algorithms capable of resisting attacks from both classical and quantum computers. Now that post-quantum cryptography (PQC) standards are available, the challenge is shifting from selecting algorithms to implementing them across real-world systems.

That transition is essential, but there is a misconception we need to avoid:

Despite popular belief, replacing vulnerable cryptographic algorithms with post-quantum ones is not always sufficient to make an organization quantum-secure. While in some systems, replacing vulnerable algorithms may address the primary quantum risk, in others, that approach is only one part of the solution.

PQC is a critical component of quantum security, but quantum security can extend well beyond PQC.

Encryption protects data. Security protects systems.

Consider how digital trust works today. When you connect to a bank, access a government service, install a software update, communicate with a device, or authenticate yourself to a network, you are relying on much more than an algorithm.

You are relying on identities.

Keys.

Certificates.

Devices.

Software.

Hardware.

Networks.

And the processes that connect them.

Public-key cryptography is fundamental to establishing trust between many of these systems. Cryptography alone is not enough. The security of that trust also depends on how keys are generated, protected, managed, and ultimately trusted.

Think of it this way: replacing a lock with a stronger lock is important, but it matters much less if you do not know who holds the keys, whether the door itself is secure, or whether there is an unsecured backdoor.

The same principle applies to quantum security.

The transition itself creates risk

Modern organizations do not operate a handful of isolated cryptographic systems. Cryptography is embedded throughout the digital infrastructure: applications, servers, cloud environments, connected devices, industrial systems, software libraries, identity systems, communications networks, and hardware that may remain operational for many years. In many organizations, no one has a complete picture of where all of that cryptography resides, and that creates a fundamental problem:

You cannot migrate what you cannot see.

Before organizations can become quantum-secure, they need to understand where vulnerable cryptography exists, which systems depend on it, how long those systems will remain operational, and what happens when cryptographic standards change again.

The challenge is therefore not simply migration. It is visibility, control, and adaptability.

Quantum security is a lifecycle

The goal should not be to replace today’s cryptography once and declare the problem solved. The goal should be to build systems capable of adapting as threats, standards, and technologies change.

That means thinking about cryptography as a lifecycle. Organizations need to know what cryptographic assets they have. They need to understand which systems and dependencies are affected. They need a way to prioritize migration based on risk. They need to manage keys and identities throughout that transition. And increasingly, they need architectures that allow cryptographic components to change without requiring entire systems to be rebuilt.

This concept is often described as crypto-agility.

In simple terms, crypto-agility means designing systems so that cryptography can evolve without the infrastructure becoming obsolete. That capability may ultimately prove as important as the algorithms themselves.

Beyond cryptography: platform security

There is another layer that deserves greater attention: the security of cryptography ultimately depends on the platform on which it operates.

At this year’s International Cryptographic Module Conference in Washington, D.C., this issue repeatedly surfaced during discussions about post-quantum migration. Organizations can become so focused on replacing cryptographic libraries that they overlook the security of the underlying platform.

That distinction matters.

A post-quantum algorithm can protect a cryptographic operation. But it cannot, by itself, guarantee that the device performing that operation has not been compromised, that its firmware has not been altered, or that its cryptographic keys are being generated and protected in a trustworthy environment.

Hardware can provide an important anchor here. Unlike software, which can be copied or modified relatively easily, physical components can provide stronger foundations for establishing device identity and protecting sensitive operations.

This raises a different set of questions:

Can we trust the device itself?

Can its identity be verified?

Has its firmware been altered?

Where and how are its cryptographic keys generated and protected?

Can we establish that a component joining a trusted network is actually the component it claims to be?

These are questions of platform security and post-quantum algorithms alone cannot answer them.

From post-quantum cryptography to quantum security

None of this diminishes the importance of PQC, quite the opposite. Migrating vulnerable cryptography is one of the most urgent and complex security transitions organizations will undertake in the coming years. But we should be careful not to confuse an essential step with the entire journey. The lesson from previous technology transitions is that security failures often occur at the boundaries between technologies, people, processes, and systems.

Quantum security will be no different. The organizations that prepare successfully will therefore need to ask more than:

“Have we replaced our vulnerable cryptography?”

They need to ask the more critical question:

“Can we continue to trust the platforms, identities, keys, and infrastructure on which that cryptography depends?”

That is something harder to answer. The Quantum Era will not only challenge the mathematics behind modern security, but it will also challenge the platforms and architectures on which digital trust is built. Preparing for that challenge requires us to think beyond encryption, and that thinking needs to start today.

In my next article, I will explore a concept that sits at the center of the Quantum Era: digital trust. What does it actually mean, and why could it become one of the defining security challenges of the years ahead?