Why the next generation of cybersecurity will require the ability to change cryptography—not simply replace it.

For nearly half a century, modern computing has depended on a relatively stable foundation of public-key cryptography. Encryption, digital signatures and authentication became embedded throughout applications, networks, devices and enterprise infrastructure, creating the trust mechanisms on which the digital economy operates.

That stability enabled extraordinary growth. It also encouraged an architectural assumption that is becoming increasingly difficult to defend: once cryptography is implemented, it can remain largely unchanged for much of a system's operating life.

The transition to post-quantum cryptography is beginning to challenge that assumption. New standards, evolving cryptanalytic techniques and increasingly complex technology environments are forcing organizations to reconsider not only which algorithms they use, but how cryptographic capabilities are discovered, managed and updated.

The next generation of cybersecurity may be defined less by the algorithms organizations adopt than by their ability to change those algorithms without disrupting the systems they protect.

There is no universally accepted date for the arrival of a cryptographically relevant quantum computer. But organizations do not need one to understand the strategic problem.

THE ARCHITECTURAL PROBLEM

Fifty years of stability created a different kind of technical debt.

Public-key cryptography became successful partly because it could be embedded directly into the technologies organizations depended upon. Software developers incorporated cryptographic libraries into applications, manufacturers built cryptographic functions into devices, and infrastructure providers implemented encryption and authentication throughout networks and computing environments.

Over time, cryptography became both ubiquitous and difficult to see.

That creates a significant challenge for the post-quantum transition. An enterprise may understand its primary security platforms yet have limited visibility into the cryptographic mechanisms operating inside legacy applications, embedded devices, third-party products, authentication systems and interconnected services.

During a recent ACT-IAC discussion on post-quantum cryptography, a Customs and Border Protection technology leader described how an early proof-of-concept exposed considerably more cryptography across the agency's environment than initially anticipated. The experience illustrates a problem likely to extend well beyond any single organization: the systems requiring migration may be far more extensive than existing inventories suggest.

The difficulty is compounded by interdependence. Federal systems exchange information across agencies, contractors, cloud platforms and commercial technology providers. Updating cryptography in one environment may require corresponding changes elsewhere, often across organizations operating under different budgets, acquisition schedules and technical constraints.

The challenge is no longer simply identifying vulnerable cryptography. It is understanding the architecture that connects it.

THE MIGRATION PARADOX

The more essential a system becomes, the harder it may be to change.

The post-quantum transition presents an unusual operational challenge. Many of the systems most important to national security, economic activity and public services are also the systems least able to tolerate disruption.

Federal border operations, financial transactions, logistics networks, identity infrastructure and mission-critical communications depend on continuous availability. Replacing cryptographic mechanisms across these environments cannot be approached as a routine software upgrade, particularly when legacy technologies and external dependencies must continue operating throughout the transition.

The ACT-IAC discussion provided a practical illustration. CBP described plans to introduce PQC protection around two high-value assets using a measured approach intended to generate implementation experience before broader deployment. The agency also identified potential uncertainties involving network performance, application interactions and interoperability.

That approach reflects an important reality: agencies cannot necessarily migrate every system simultaneously, nor can they assume that all connected organizations will adopt the same cryptographic capabilities on the same schedule.

The result is a period in which classical and post-quantum cryptography must coexist, potentially for years. Organizations will need to maintain secure communications across different technology generations while retaining the ability to change their architectures as standards, implementations and threats evolve.

A successful migration must therefore accomplish two objectives that can appear contradictory: fundamental cryptographic change and operational continuity.

THE NEXT SECURITY ARCHITECTURE

Cryptography may become a continuously managed enterprise capability.

One of the most interesting ideas raised during the ACT-IAC session was the comparison between cryptographic management and the evolution of identity and access management.

Historically, organizations embedded authentication functions directly into individual applications. As environments expanded, that approach became increasingly difficult to maintain. Enterprises gradually adopted centralized and federated identity services, allowing many authentication policies and capabilities to be managed more consistently without requiring every application to implement them independently.

A comparable architectural shift may now be emerging in cryptography.

Rather than treating cryptographic mechanisms solely as functions embedded within individual applications and devices, organizations may increasingly manage selected capabilities through enterprise services, common interfaces and coordinated policy frameworks. Such approaches could make it easier to introduce new algorithms, support different cryptographic implementations and respond when existing protections require modification.

The analogy is useful, but it has limitations. Cryptography serves many different purposes, and not every operation can or should be centralized. Hardware constraints, performance requirements, latency, availability and security boundaries will continue to influence where cryptographic functions reside.

The more significant opportunity is therefore not necessarily centralization itself. It is architectural control: the ability to understand where cryptography operates, determine which protections are appropriate, coordinate changes and maintain interoperability without rebuilding entire technology environments.

This is the underlying promise of crypto-agility. It is not simply the ability to support several algorithms. It is the ability to adapt cryptographic protections as requirements change, with minimal disruption to the systems and missions that depend upon them.

HARDWARE, IDENTITY AND THE NEXT TRUST LAYER

The infrastructure industry is beginning to build for cryptographic change.

Recent developments suggest that this architectural transition is no longer confined to federal migration planning.

In October, Microsoft introduced Project Tessera in collaboration with Marvell, Oracle and the Open Compute Project. The initiative seeks to advance open hardware-security technology that protects cryptographic keys closer to the workloads they serve. Microsoft and Marvell also demonstrated interoperability between different hardware security modules using post-quantum cryptography to secure their communications.

Tessera approaches the challenge from the hardware layer, while the ACT-IAC discussion highlighted the enterprise-management and operational layers. Both point toward a future in which cryptographic protection must be stronger, more interoperable and easier to adapt.

Federal identity infrastructure introduces another dimension. During the ACT-IAC session, a GSA representative described experimentation involving quantum-resistant credentials, public-key infrastructure, security tokens and nonhuman identities. These efforts illustrate how the transition may extend beyond encryption into the systems that establish and verify trust between people, devices and increasingly autonomous software agents.

Taken together, these developments suggest that cryptographic modernization could become a broader architectural undertaking involving hardware protection, identity, discovery, policy management and interoperability. They do not establish that a single new architecture will dominate, but they provide evidence that the industry is exploring multiple approaches to the same underlying challenge.

THE NEW CRYPTOGRAPHIC OPERATING MODEL

Visibility, control and adaptability may become permanent requirements.

A future cryptographic operating model would begin with continuous visibility. Organizations need to understand which algorithms, certificates, keys, protocols and dependencies exist across their environments, where those capabilities are deployed and which systems depend upon them. NIST's migration work already emphasizes cryptographic discovery, inventory and interoperability as foundations for managing the transition.

Visibility alone, however, does not produce agility. Organizations also need the ability to establish policies, evaluate dependencies, test alternative cryptographic implementations and coordinate changes across technology environments without introducing unacceptable operational risk.

This is particularly important as artificial intelligence begins accelerating software development, vulnerability research and other cybersecurity activities. The ACT-IAC panel discussed examples of AI-assisted cryptanalysis and implementation analysis, underscoring concerns that organizations may need to respond to cryptographic developments more frequently than they have historically. Those specific technical examples require independent verification, but the broader architectural lesson remains relevant: systems should be designed to accommodate future cryptographic change rather than assume that today's implementations will remain suitable indefinitely.

NIST's crypto-agility guidance explicitly addresses the need to adapt cryptographic algorithms across software, hardware, firmware and infrastructure while preserving security and ongoing operations. The objective is not continual replacement for its own sake, but the ability to respond when changing risks or requirements make replacement necessary.

For federal agencies, this capability could ultimately become as fundamental to enterprise architecture as identity management, network security or configuration management.