What breaks first. What matters most. What to do now.
The uncomfortable truth: your encryption strategy already carries future risk
Most security leaders assume their encrypted data is safe today.
That assumption doesn’t hold up anymore.
The real issue isn’t timing. It’s how long that data needs to stay secure.
Attackers are already collecting encrypted traffic, credentials, and sensitive datasets with the expectation that future quantum systems will decrypt them.
This is already happening in live environments.
- The National Security Agency has already mandated transition planning under CNSA 2.0
- The National Institute of Standards and Technology has finalized PQC standards (Kyber, Dilithium)
- Gartner estimates that by 2030, most encryption in use today will be considered unsafe for long-term protection
At the same time:
- Over 60% of enterprises do not have a complete inventory of cryptographic assets (industry surveys across PKI vendors)
- Large enterprises manage 10,000–100,000+ certificates, many without lifecycle visibility
- Enterprises typically manage 50,000+ certificates across environments (Venafi)
- Up to 70% of sensitive enterprise data requires protection beyond 10 years
What this means in practice is:
You already have data at risk. You just don’t know which systems will fail first.
There is a second, more immediate shift happening in parallel.
Even before encryption fails, enterprises are already seeing systems produce incorrect outputs because they are being influenced by untrusted inputs.
This is visible today in AI systems, where techniques like prompt injection can manipulate how models interpret information and generate responses.
The common thread is not the technology.
It is trust.
Across both cryptography and AI, the problem is the same:
systems are being trusted to interpret inputs correctly, and that assumption is starting to break.
What breaks first (and what actually matters)
Most organizations will get this wrong by starting with TLS upgrades instead of fixing identity and PKI dependencies.
They will start with network encryption.
That is not where the highest risk is. This isn’t just a cryptography upgrade.
It changes how systems verify and trust each other in practice.
Priority order based on real enterprise impact:
- Identity and digital signatures
- PKI and certificate infrastructure
- Long-lived data (cloud, storage, backups)
- Network encryption (TLS, VPNs)
- Devices and embedded systems
The biggest mistake CISOs will make is treating PQC as a network upgrade instead of a trust-layer redesign.
1. Identity and digital signatures (highest risk)
If signatures fail, trust fails.
Scenario: Financial services
- Transaction signing algorithms become vulnerable
- Attackers forge approval signatures
- Fraud occurs without a system breach
In a payment workflow, if signing keys become forgeable, an attacker does not need access to your systems.
They only need to generate valid signatures that your systems already trust.
A similar pattern has already been observed in certificate and signing failures during algorithm transitions.
In several enterprise environments, deprecated cryptographic algorithms have caused validation failures across services, leading to outages and emergency certificate rotations.
PQC introduces the same risk at a larger scale. The difference is the number of systems affected simultaneously.
Impact:
- Unauthorized transactions
- Regulatory exposure
- Loss of transaction integrity
2. PKI and certificate infrastructure
This is where most organizations are structurally weakest.
Reality:
- Certificates are everywhere
- Ownership is fragmented
- Rotation is inconsistent
Scenario: Enterprise SaaS
- Certificate algorithm deprecated
- Applications fail to validate trust chains
- Service outages occur during migration
Impact:
- Downtime
- Broken integrations
- Emergency re-architecture
3. Long-lived data (your biggest hidden liability)
This is the core of “harvest now, decrypt later.”
Scenario: Healthcare
- Patient data encrypted today
- Decrypted 10–15 years later
Impact:
- Lifetime data exposure
- Legal liability
- Regulatory penalties
Key insight:
If data must remain secure beyond 2035, it is already exposed.
4. Network encryption (mis-prioritized by most CISOs)
Yes, TLS will break.
But it is not the first system that collapses.
Scenario: Enterprise APIs
- Encrypted traffic recorded today
- Decrypted later
Impact:
- API payload exposure
- Credential leakage
Reality:
Network encryption failures are easier to detect and fix.
Identity and PKI failures tend to cascade across systems.
5. Devices and embedded systems (long-term risk)
Scenario: Industrial systems
- Firmware signing algorithms become obsolete
- Devices cannot be updated
Impact:
- Persistent vulnerability
- Operational risk in critical infrastructure
This pattern—systems behaving correctly but producing compromised outcomes—is not limited to cryptography.
In AI-driven environments, similar failures are already happening today.
Systems are not being breached in the traditional sense; instead, they are being influenced.
Prompt injection attacks demonstrate how easily decision-making systems can be manipulated without triggering security alerts.
The implication is broader than PQC:
Security is no longer just about preventing access.
It is about ensuring systems can be trusted to make correct decisions.
Why most enterprises will struggle to respond
Most organizations don’t fail here because of cryptography.
They fail because no single team owns it end-to-end.
1. No cryptographic visibility
Most CISOs cannot answer:
- Where is encryption used?
- Which algorithms are deployed?
- What depends on them?
2. No crypto-agility
In most environments:
- Algorithms are hard-coded
- Dependencies are unknown
- Replacement risks downtime
Reality:
Most systems were never designed to swap out cryptography.
