Preparing Now for Quantum Vulnerable Access before 2028

Critical infrastructure operators make technology decisions that span decades, making the shift to Post-Quantum Cryptography an immediate design priority rather than a distant exercise. Advanced adversaries are already executing “Harvest Now, Decrypt Later” attacks by intercepting and storing encrypted data today to decrypt once quantum computing reaches maturity.

Implementation mandates and standards are now firmly established. In August 2024, the National Institute of Standards and Technology (NIST) published the world’s first official post-quantum cryptography standards: FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA), from an eight-year global effort to replace quantum-vulnerable public-key algorithms.

Building on this foundation, the NSA’s Commercial National Security Algorithm Suite 2.0 (CNSA 2.0) requires new equipment acquisitions to default to PQC compliance starting January 1, 2027, with exclusive PQC enforcement for key networking equipment mandated by 2030.

”

“The issue is no longer whether standards exist. The issue is whether your architecture allows you to adopt them without a physical visit to every site.”

While 2030 marks the federal target for full migration, the broader cybersecurity community views 2028 as the operational tipping point. Current threat intelligence models estimate 2028 to 2030 as the earliest window for a Cryptographically Relevant Quantum Computer to emerge.

At the same time, international frameworks, such as the UK National Cyber Security Centre PQC Roadmap, set 2028 as the target to complete cryptographic discovery and begin active migration of high-priority assets. Given the multi-decade lifecycles of industrial hardware, 2028 serves as the operational benchmark to have updateable, quantum-resilient access controls fully deployed.

Commercial technology leaders are not waiting for government enforcement to implement these NIST standards. Browsers such as Google Chrome and Microsoft Edge, along with network providers like Cloudflare, have already deployed hybrid key exchanges by default, combining legacy algorithms like X25519 with FIPS 203 (ML-KEM) to protect active web traffic. Critical infrastructure environments face the same operational imperative to adopt hybrid key exchanges to secure operational technology data streams.

Navigating this transition without forcing disruptive hardware replacement cycles requires an architectural shift toward Zero Trust OT SASE. A software-defined gateway approach provides the foundation for managing cryptographic updates across thousands of distributed, long-life assets. Where traditional operational technology relies on fragmented networks and costly manual intervention, a software-defined model enables managed remote updates, allowing operators to push cryptographic updates to edge devices via the cloud without interrupting core building operations.

While these initial NIST standards establish a baseline for data transit and identity verification, long-term resilience requires mathematical diversity. Because primary standards like ML-KEM and ML-DSA both rely on structured lattices, a breakthrough in lattice cryptanalysis could compromise both simultaneously. Secure architectures must incorporate alternative mathematical families, leveraging NIST’s hash-based fallback standard, FIPS 205 (SLH-DSA), alongside ongoing evaluations of non-lattice schemes, such as code-based and isogeny-based algorithms, to maintain cryptographic agility over the operational lifespan of the asset.