How to Conduct a Post-Quantum Cybersecurity Audit

Security companies and standards bodies broadly agree that the migration to quantum-resistant encryption starts not with new algorithms but with a post-quantum cybersecurity audit — a systematic inventory of where, how and why an organization scrambles its data. Skipping that step turns every later decision into guesswork.

“You cannot protect what you do not know exists,” Palo Alto Networks, the cybersecurity company, wrote in its guide to post-quantum cryptography.

The urgency stems from a threat that does not require a working quantum computer today. Under a tactic known as “harvest now, decrypt later,” adversaries intercept and warehouse encrypted traffic now, wagering they can unlock it once a powerful enough machine — what specialists call a cryptographically relevant quantum computer — arrives. Qtonic Quantum, a firm that sells quantum-risk assessments, projects that arrival between 2028 and 2035. Palo Alto Networks places it roughly 10 to 15 years out. Either estimate means data that must stay secret for a decade or more is, in practical terms, already exposed.

The reason a quantum machine threatens today’s encryption is mathematical. Most of the secure web rests on a handful of problems — factoring very large numbers and computing discrete logarithms — that ordinary computers cannot solve in any reasonable time. A quantum algorithm published in 1994 by mathematician Peter Shor can. That puts RSA, elliptic curve cryptography and Diffie-Hellman key exchange — the systems behind most web sessions, virtual private networks and digital signatures — at risk. Symmetric encryption such as the AES standard, used to scramble stored data, is far less threatened; doubling its key length to AES-256 is considered sufficient, both sources said.

Start With an Inventory

The audit’s foundation is a cryptographic inventory. Palo Alto Networks recommends documenting every algorithm, protocol, certificate, key, software library, hardware security module, application, programming interface and third-party dependency an organization relies on. Qtonic Quantum frames the same exercise as building a “cryptographic bill of materials,” a running ledger of every place encryption appears, and sets a benchmark of covering at least 95% of enterprise systems.

The hard part is visibility, according to most experts. For example, research from Unit 42, Palo Alto Networks’ threat-intelligence unit, has found that many organizations cannot see their own “shadow” certificates and aging applications that rely on hardcoded, noncompliant encryption. The inventory’s job is to surface those blind spots and flag where the vulnerable algorithms — RSA, elliptic curve cryptography and Diffie-Hellman — are in use.

Measure the Risk

A complete inventory matters only if it is ranked with both firms tracing the prioritization to a rule of thumb credited to cryptographer Michele Mosca. The Mosca inequality holds that if the length of time data must remain secret, plus the time needed to migrate systems, exceeds the time until quantum computers can break encryption, an organization is already behind and must act now. By that math, records with long lifespans are the most urgent.

From there, auditors classify data by how long it must stay confidential and map cryptography to the systems that matter most 00 identity and access controls, financial transactions, regulated records, critical infrastructure and software-update channels. Qtonic Quantum advises prioritizing what it calls crown-jewel data: merger plans, litigation holds, health records and financial archives. The goal is a risk-ranked list, not a flat catalog.

Map Deadlines and Vendors

External deadlines should anchor the timeline. The National Institute of Standards and Technology finalized its first three post-quantum standards in August 2024: ML-KEM, designated FIPS 203, for key exchange; ML-DSA, or FIPS 204, for digital signatures; and SLH-DSA, FIPS 205, a hash-based backup should the others prove weak. A fourth, FN-DSA, is still being finalized. Federal agencies face an Office of Management and Budget directive to complete cryptographic inventories, and the National Security Agency’s CNSA 2.0 suite sets deadlines for national security systems running through the early 2030s, according to Qtonic Quantum’s compilation of regulatory dates. Banking regulators and the payment-card industry have issued their own requirements.

The audit should also reach outside the organization. Palo Alto Networks advises asking every vendor how it will support the NIST standards, hybrid modes and certificate migration, and writing post-quantum readiness into procurement contracts. A migration is only as fast as its slowest supplier.

Test, Then Migrate

Auditors are advised to pilot the new algorithms in test environments before touching production, because post-quantum cryptography is not a drop-in swap. Its keys and signatures are substantially larger than today’s, which Palo Alto Networks warns can overflow the size limits of a TLS “handshake” — the opening exchange that sets up a secure connection — and cause dropped or fragmented connections. The added computation can also slow trading systems and drain low-power devices.

To bridge the gap, both sources endorse “hybrid” cryptography, which runs a classical algorithm and a post-quantum one together so that an attacker must break both. The broader aim is “crypto-agility” — building systems so an algorithm can be swapped out without re-engineering everything around it, allowing a quick pivot if a standard is later found flawed. Migration should proceed in phases, starting with the highest-risk and longest-lived data and public-facing systems, followed by a post-migration audit to confirm the gaps were closed and continuous monitoring of new cryptographic research.

None of it is quick. Qtonic Quantum estimates a typical enterprise migration takes three to five years, and past cryptographic transitions have run longer. That is the case both firms make for starting the audit now, well before a quantum computer capable of breaking encryption is known to exist. The standards are set and the tools are available; what remains is the inventory — knowing what an organization has, where it lives and how long it must stay secret.