Insights on post-quantum cryptography

Stop sharing your keys. Start sharing capabilities

I've spent seven articles arguing that cryptography must be decoupled from applications and governed as infrastructure, with the post-quantum transition as the catalyst. This article is about a different problem.

Your TLS upgrade won't save you — Part VII: what becomes possible when cryptography is decoupled

In Part VI, I laid out the Enterprise Cryptographic Modernization Program: three parallel tracks, four phases, concrete timelines. This is the final article in a seven-part series.

Your TLS upgrade won't save you — Part VI: the three-track migration

In Part V, I introduced CAPA and the Cryptographic Maturity Model — a diagnostic framework that tells organizations where they stand and what capabilities they need to build.

Your TLS upgrade won't save you — Part V: CAPA and the Cryptographic Maturity Model

In Part IV, I introduced the Cryptographic Control Plane — the architectural layer that separates what applications need from how cryptographic operations are executed.

Your TLS upgrade won't save you — Part IV: the Cryptographic Control Plane

In Part III, I showed that cryptography is following the same architectural pattern as identity, networking, and secrets management — a critical capability that started embedded in applications and must eventually be externalized into governed infrastructure.

Your TLS upgrade won't save you — Part III: the next infrastructure abstraction is cryptography

In Part I, I argued that quantum safety must begin at the data layer. In Part II, I made the case that the real disruption isn't post-quantum cryptography — it's architectural rigidity.

Your TLS upgrade won't save you — Part II: post-quantum is not the disruption. Architectural rigidity is.

In my previous article, I argued that upgrading TLS is not enough. Quantum safety must begin at the data layer.

Your TLS upgrade won't save you: why quantum safety must start at the data layer

The cybersecurity industry is racing to prepare for the post-quantum era. But most organizations are making a critical strategic error: they're focused on upgrading their transport channels while leaving the actual data unprotected.

How is Kyber validated against quantum attacks without quantum computers?

One of the most common questions when discussing post-quantum cryptography is: “How can we trust that Kyber or other algorithms will resist quantum attacks if we don’t yet have a quantum computer that can break RSA or ECC?”