A cryptographic inventory may reveal a problem an enterprise can’t solve on its own: A supplier has no clear upgrade path for a product the organisation depends on.
At the Post-Quantum Security Summit in Singapore, jointly organised by Jicara Media‘s Quantum Spectator and Frontier Enterprise, the “Assessing Enterprise Exposure to Quantum Risk” panel, moderated by Dr Scott Flower, Co-Founder & CEO at CI-ISAC International, examined how organisations can plan a move to quantum-safe security when they are still discovering what their systems use and what their suppliers can support.
Plan before the upgrade
Mohan Veloo, Chief Technology Officer, APJC at F5, said procurement decisions made now could complicate a later migration. Buyers need to ask vendors about their quantum-safe plans and include cryptographic agility in purchasing requirements. Otherwise, he warned, “you might be buying technical debt.”
Veloo argued that attention often goes to questions no one can yet answer, particularly when a sufficiently capable quantum computer will arrive. “Public key cryptography is embedded throughout the entire technology stack,” he said. Migration will take time, while some information must remain confidential for decades. The focus, he said, “needs to move towards managing exposure.”
For Eric Wong, Director, Cyber Operations & Technologies at Synapxe, an organisation’s size and complexity influence the time and preparation needed to migrate to quantum safe solutions. He likened smaller, less-complex companies to speedboats, which can change direction quickly. Larger, more complex organisations are more like oil tankers: they need considerably more time and room to change course. “You really need to plan it out,” he said.
Wong said a cryptographic inventory must cover dependencies as well as assets. Given the potential costs of replacing cryptography across a large environment, he suggested planning ahead to align migration efforts with scheduled technology refreshes rather than making costly, ad hoc system changes.
Costs and supplier readiness
Phoram Mehta, Vice President & Head of International Cyber Risk at PayPal, shared that security teams have not always explained cryptographic change in terms that management can use to make investment decisions. “We have to make it a business problem, a business discussion,” he said.
Mehta said a migration could affect transaction processing, storage, signing, and audit records. “Is it a storage problem? Is it a processing speed problem?” he asked. He also noted that discussions with business leaders should address those operational effects and resilience, rather than focus on cryptography alone.
Mehta also highlighted that for companies like PayPal, a payment passes through systems outside any one team’s control. He described touchpoints extending from a customer’s device through gateways, networks, issuers, and settlement. Across that journey, he said, protection will depend on “whoever is the weakest in the entire chain.” Organisations therefore need to identify their cryptography and data flows and work with the vendors supporting critical operations.
Wong said regulatory deadlines could be a useful prompt for the industry to act. For example, Synapxe had engaged vendors over the past two years on their quantum safe roadmaps, and found that vendor readiness varied across the industry. These insights helped shape its technology migration and refresh cycles.
Mehta suggested piloting suitable applications with vendors that support critical operations. The results, he said, could inform discussions about longer-term investment with business, risk, and compliance teams.
Follow the data and its dependencies
Veloo said the value and confidentiality lifetime of data should shape migration priorities. Organisations should also consider whether information can be intercepted now and how difficult the systems protecting it will be to migrate.
Mehta advised organisations to examine how long they retain data, where it travels, and which partners hold or process it. That includes data shared for limited engagements: a company needs to know where the information sits and who remains accountable for it.
Wong cautioned that attackers will use an easier route if one is available, including an exposed management interface or a poorly secured third party. They do not need a quantum computer to exploit such weaknesses. He urged organisations to examine the security of partners with trusted access to critical systems.
Asked about cryptographic inventories, Wong said organisations can draw on information they already collect. Network monitoring tools, for example, can help identify cryptography used in communications. But an inventory must also capture dependencies between assets: “It’s not just about the assets, but what are the dependencies also?” he asked.
Veloo cautioned that cryptography is embedded across hardware and software, so no single discovery product can reveal everything. He said organisations would need to draw on multiple sources of information.
“Starting is the most important thing,” Mehta said. He suggested testing a library on one application or finding a partner willing to take part in an interoperability pilot as a first step.
