Practice 01 · Post-quantum
Move to post-quantum before it is urgent.
Traffic and archives captured today can be decrypted once a cryptographically relevant quantum computer exists, and the deadlines are now on paper: US federal systems by 2030, NIST's finish line in 2035. We start with a two-week readiness sprint, then a full assessment of where vulnerable cryptography lives and which data outlives it, and move the systems that matter to hybrid post-quantum designs, with a rollback path at every step.
Scope
- PQC migration
- Crypto-agility
- Key management
- Quantum-safe networks
Why now
Security is moving from retrofit to mandatory spend.
PQC
2035
Standards deadline
NIST finalised its first post-quantum standards in 2024 and targets removal of quantum-vulnerable algorithms by 2035, with earlier action for high-risk systems.
Source: NIST
Where to start
One engagement, scoped to an outcome.
Start with · Assessment
Quantum-readiness and crypto-agility assessment
Where quantum-vulnerable cryptography lives across your estate, which data outlives it, and the order in which to move it, with a plan your board and regulator will accept.
- Type
- Assessment
- Shape
- 6–10 weeks, fixed scope
- For
- Banks, insurers, payments, government and critical infrastructure
- Roadmap / Scoped in proposalPost-quantum migration roadmapTurn exposure into a phased programme: which systems move first and which wait on a dependency, where hybrid operation keeps trust unbroken, who decides, funds and accepts residual risk, and the measures that show it is moving rather than merely planned.
- Strategy / Scoped in proposalCrypto-agility strategyPost-quantum will not be the last cryptographic change. We find where algorithms, certificates and trust anchors are hard-coded, then design the architecture, governance and operating model that let you swap them without rebuilding the estate.
Method
Four pillars, one evidence base.
Each stage hands the next one artefacts to build on, from the first scan to board reporting.
- 1
Stage 01
Assess
Know your exposure, by data class.
- Six-dimension readiness scan
- Mosca analysis (X + Y vs Z) for every data class
- Gap analysis against DORA, NIST and EU guidance
Output
- Mosca analysis
- Regulatory gap analysis
- 2
Stage 02
Discover
Find every algorithm, key and certificate.
- Automated discovery across code, TLS, PKI and cloud
- CycloneDX cryptographic bill of materials (CBOM)
- Priority scoring for harvest-now, decrypt-later exposure
Output
- CycloneDX CBOM
- Priority scoring
- 3
Stage 03
Migrate
Move to hybrid post-quantum designs, safely.
- Hybrid ML-KEM and ML-DSA reference designs
- PKI, HSM and KMS re-architecture
- Production pilots with rollback paths
Output
- Reference designs
- Production pilots
- 4
Stage 04
Assure
Prove it, continuously, to boards and regulators.
- CBOM drift monitoring
- Stage 0–5 maturity, scored on shipped evidence
- Board and regulator reporting
Output
- CBOM drift watch
- Board reporting
Delivery partner
QDefence, our PQC delivery partner.
Year-one post-quantum delivery partner for readiness sprints, crypto discovery, migration architecture and assurance.
- Co-founded by our CTO and a NIST PQC contributor
- Arm's-length, year-one partner
- Client contracts sit with QCT Studio
- 01
Readiness & discovery
Readiness sprints, QGuard crypto discovery, CBOM and harvest-now, decrypt-later exposure scoring.
- 02
Migration architecture
Hybrid post-quantum designs for transport, PKI and firmware; HSM and KMS redesign.
- 03
Assurance & advisory
CBOM drift monitoring, stage 0–5 reporting, and board and regulator briefings.
Disclosure. QDefence was co-founded by our CTO and a NIST PQC contributor. It works with QCT at arm's length, and client contracts sit with QCT Studio.
Let's talk
Start with two weeks.
A fixed-fee readiness sprint: an exposure heatmap, a Mosca analysis and your top ten priorities.
Get in touch
contact@qctcapital.com