Cryptographic inventory
Algorithms, keys and certificates across applications, infrastructure, vendors and devices.
Service 07
Quantum-safe readiness
Australian Signals Directorate guidance sets the end of 2030 to stop using traditional asymmetric cryptography. We find where it lives across your organisation and plan a safe, staged move to post-quantum cryptography.
Why now
Harvest now, decrypt later.
Encrypted data stolen today can be decrypted once quantum computers mature. Migration takes years across vendors, devices and code, so leaders who start planning now control the cost and the risk.
- Know exactly where vulnerable cryptography is used
- Protect long-lived sensitive data first
- Budget the transition with a credible, staged roadmap
What we deliver
From inventory to roadmap.
Risk ranking
Prioritised by data sensitivity and how long it must stay secret.
Crypto-agility assessment
How easily each system can change algorithms, and what blocks it.
Vendor readiness
Questions and evidence to request from suppliers about their post-quantum plans.
Migration roadmap
A staged plan aligned to ASD guidance and the NIST standards, with costs and owners.
Board summary
A clear, non-technical brief on exposure, plan and budget.
Engagement
Quantum-Safe Readiness
Three to four weeks, led by a team with hands-on quantum computing expertise, not just security checklists.
from A$14,000
Is quantum computing a real threat yet?
A quantum computer able to break today's public-key cryptography does not exist yet, but adversaries can record encrypted data now and decrypt it later. Data that must stay secret for years is already at risk.
What are the new standards?
In August 2024, NIST published the first post-quantum standards: ML-KEM for key establishment (FIPS 203), and ML-DSA and SLH-DSA for digital signatures (FIPS 204 and 205). Australian guidance points organisations to these algorithms at their strongest settings.
Where should we start?
With an inventory. You cannot migrate cryptography you cannot find. Most organisations discover algorithms in vendor products, certificates, VPNs, code and devices they did not know about.
Does this apply to us if we are not in government?
The ASD guidance is written for Australian organisations broadly and is most pressing for government suppliers, critical infrastructure, financial services, health and anyone holding long-lived sensitive data.
Related