AI and ML
Unlocking the relational power of graph neural networks in fraud prevention
Executive summary
For nearly half a century, global digital commerce, banking, healthcare and sovereign communications have operated on a single assumption: asymmetric encryption algorithms like RSA and Elliptic Curve Cryptography (ECC) are computationally unbreakable. That foundation is collapsing. Cryptographically Relevant Quantum Computers (CRQCs) will break classical asymmetric encryption.
The threat to enterprise data is not a distant future risk. Through Harvest Now, Decrypt Later (HNDL), threat actors are intercepting and storing encrypted corporate data today to decrypt retroactively the moment quantum capabilities mature. Simultaneously, Trust Now, Forge Later (TNFL) threatens digital identity by undermining signature validation across legal agreements, API authentication and software updates.
To mitigate this systemic risk, international security bodies have standardized Post-Quantum Cryptography (PQC): quantum-resistant algorithms designed to execute on classical hardware. The rise of autonomous Agentic systems and machine-to-machine interactions further escalates the risk of PQC failure due to automated execution and expanded attack surfaces. Transitioning to PQC is no longer an optional IT exercise. It is an immediate operational, compliance and board-level governance mandate.
1. The collapse of classical encryption
Enterprise security architectures rely on asymmetric public key infrastructure to govern secure sessions, identity verification, tokenized transaction signing and key distribution. These systems rely on mathematical problems whose computational complexity scales exponentially on classical supercomputers.
[ X: Data Shelf Life ] + [ Y: Migration Time ] >= Z (Time to Quantum)
The mathematical timeline governing quantum risk is expressed through Mosca's Theorem:
$X$ (Shelf Life): The duration for which data must remain confidential (for example, patient records, core financial ledgers, trade secrets).
$Y$ (Migration Time): The operational timeframe required to re-architect systems, eliminate cryptographic debt and deploy PQC standards.
$Z$ (Time to CRQC): The estimated timeframe until a cryptographically relevant quantum computer becomes operational.
The strategic reality: If your organization's data must remain secure for 10 to 30 years ($X$) and your enterprise migration takes five years ($Y$), any system where $X + Y ≥ Z$ means your data is already compromised today.
2. Cryptographic technical debt and operational friction
Transitioning an enterprise to quantum-resistant standards is not a routine software patch. It represents a fundamental architectural overhaul. Recent industry surveys show that while 87% of organizations are planning or piloting PQC, only 7% have deployed quantum-safe cryptography across most of their certificate estate. Organizations face three critical operational challenges:
Deeply embedded technical debt: Cryptographic algorithms are buried inside legacy code, database schemas, third-party SaaS tools, container images and Hardware Security Modules (HSMs).
Performance anomalies and latency: PQC algorithms require significantly larger key sizes and signature payloads. Standardized lattice-based keys (such as ML-KEM and ML-DSA, which are lattice-based, quantum-resistant algorithms) are orders of magnitude larger than legacy ECC keys, triggering network packet fragmentation, TLS handshake latency and memory strain across database schemas.
Supply chain exposure: Enterprise perimeters are inherently vulnerable to third-party dependencies. Without complete visibility into vendor codebases and partner integrations, third-party software supply chains introduce backdoor quantum vulnerabilities into production environments.
3. Regulatory mandates and strategic compliance
Global regulators and national security bodies have shifted PQC adoption from advisory guidelines to enforceable legal mandates:
EU frameworks (DORA and NIS2): Under the Digital Operational Resilience Act (DORA) and NIS2, financial institutions and operators of essential services are legally bound to manage ICT cryptographic risks. NIS2 introduces explicit administrative fines reaching up to 2% of global annual turnover (or €10M) for essential entities along with direct personal liability for board members, while DORA enforces quantum readiness and crypto-agility through supervisory expectations and remediation requirements.
UK NCSC timelines: The UK National Cyber Security Centre mandates complete cryptographic discovery and inventory planning, setting strict migration horizons for critical national infrastructure and commercial enterprises.
Commercial disqualification: Institutional buyers are increasingly demanding a verified Cryptographic Bill of Materials (CBOM) during procurement. Organizations lacking a documented PQC roadmap face immediate disqualification from enterprise RFPs and vendor ecosystems.
4. A four-step roadmap for crypto-agility
PQC migration must be executed as an enterprise-wide modernization program across four sequential phases:
Discover and map (CBOM): Deploy automated scanning across repositories, network traffic and certificate stores to build a dynamic Cryptographic Bill of Materials.
Prioritize by data longevity: Target high-value data with long retention mandates and internet-facing endpoints first (Tier 1). Align lower-priority internal systems with routine technology refresh cycles.
Re-architect for crypto-agility: Build crypto-agility by abstracting cryptographic logic away from application code via gateway layers and wrappers. This ensures algorithms can be swapped via configuration as standards evolve without breaking downstream systems.
Execute hybrid deployments: Deploy hybrid cryptographic schemes pairing classical algorithms (for example, ECDH) in parallel with PQC algorithms (for example, ML-KEM). This preserves current compliance while validating real-world performance under post-quantum parameters.
Conclusion
Post-Quantum Cryptography is not a future IT initiative. It is an active risk management, governance and compliance requirement. The structural vulnerabilities introduced by Harvest Now, Decrypt Later operations mean that organizations delaying their PQC transition accumulate unmanaged liability today. Board members and executive leaders must ask three vital questions:
Data exposure: Which of our core data assets must remain confidential for the next 10 to 30 years, and are they crossing public networks today?
Supply chain risk: Do our critical software and SaaS vendors provide a validated Cryptographic Bill of Materials (CBOM)?
Regulatory readiness: Does our ICT risk strategy satisfy mandatory DORA and NCSC requirements to protect board directors from personal liability?
While the challenge is systemic, organizations can look to frontier technology leaders for open-source tools and abstraction layers designed to help address these risks.
Organizations that act now to establish complete cryptographic visibility, build crypto-agile architectures and systematically eliminate technical debt will safeguard their critical assets, maintain regulatory compliance and build long-term trust in a quantum-enabled world.
"The quantum threat is not a future event to monitor. It is an active vulnerability today. Securing the enterprise for the quantum era demands immediate, crypto-agile modernization."
