What the report covers
Quantum DevSecOps means treating the move to post-quantum cryptography as part of how you build and ship software, not as a one-off project. This report sets out the threat, the new standards and a practical framework for engineering and security teams.
- The threat. How Shor's algorithm breaks RSA, Diffie-Hellman and elliptic-curve cryptography on a large enough quantum computer, how Grover's algorithm weakens symmetric keys and hashes, and why harvest now, decrypt later puts long-lived data at risk today.
- The standards. ML-KEM (FIPS 203), ML-DSA (FIPS 204) and SLH-DSA (FIPS 205), published by NIST in August 2024, with their parameter sets, plus stateful hash-based signatures and a comparison of national policies.
- Quantum key distribution and quantum random numbers. The BB84 and E91 protocols, quantum random number generators, their practical limits, and where they complement post-quantum cryptography.
- The DevSecOps framework. Crypto-agile architecture, cryptographic checks at each stage of the CI/CD pipeline, a cryptographic bill of materials (CBOM) and hybrid classical and post-quantum deployments.
- A quantum-safe software development lifecycle. Six phases, from quantum threat modelling and data lifetime analysis to staged rollout and ongoing monitoring.
- The mathematics. Lattice problems, learning with errors, Merkle trees and the complexity of the quantum attacks, for readers who want the detail.
- A 12-week roadmap. An illustrative first wave: inventory and risk assessment, a pilot, then a staged production rollout, with deliverables and indicators for each step.
Key points
- Data that must stay confidential for more than 10 to 15 years should be treated as at risk now.
- Public-key cryptography is the urgent problem. Symmetric encryption at larger key sizes, such as AES-256, stays strong.
- You cannot migrate cryptography you cannot find. A current inventory, kept up to date by the pipeline, is the foundation.
- Crypto-agility, the ability to change algorithms through configuration, is what makes this migration, and any later change, manageable.
- Hybrid approaches let you add post-quantum protection while staying compatible with systems that have not moved yet.
Who it is for
Chief information security officers, security architects, platform and engineering leads, and DevSecOps teams planning the move to post-quantum cryptography. The first sections suit a general technical reader; the later sections assume familiarity with software delivery pipelines.
How we can help
The report is general information current at April 2026, not advice for your organisation, and the roadmap is an illustrative starting point rather than a promise of results. For a plan built around your systems, our Quantum-Safe Readiness engagement delivers the inventory, risk ranking, crypto-agility assessment and a staged roadmap. For the Australian deadlines, read Post-quantum cryptography: a 2030 plan for leaders.