Quantum Security Governance: Building a Board-Level Framework
Quantum risk briefings are now common at board level. Governance is not. This article sets out a five-element framework using NIST CSF 2.0 as the…
Blog
Insights & News
Expert analysis, quantum security news, and industry developments from QSECDEF. 175 articles across insights and news.
Articles — page 2 of 6
Nation-State Quantum Programmes and What They Mean for Enterprise Security
Every security professional has read the headlines about national quantum programmes. What most enterprise security teams have not done is translate…
HNDL in Financial Services: Regulatory and Operational Implications
Financial services institutions hold the data categories with the longest regulatory retention periods, are documented targets of nation-state cyber…
Quantum Progress 2026: IBM, Google, Microsoft, IonQ Fault-Tolerance Roadmaps
The IBM Nighthawk and Google Willow announcements attracted more executive-level attention than any quantum hardware development in years. Both…
The Case for a Dedicated Quantum Security Membership for Your Organisation
Security teams at financial institutions, critical infrastructure operators, and defence contractors typically carry memberships with ISC(2), ISACA,…
Quantum Security Training for Security Professionals: What to Look For
Quantum security training is a buyer's market in the worst sense: provider marketing has converged on the same vocabulary regardless of actual…
CNSA 2.0 Compliance Guide: What US Defence Contractors Must Do
The NSA's preferred schedule had 2025 as the target year for software and firmware signing. That date has passed. This article works through each CNSA…
NIST Algorithm Deprecation Timeline: When RSA, ECC, and SHA-1 Are Officially Retired
NIST IR 8547 is not a threat assessment document. It is a schedule. This article provides the specific dates, specific algorithm names, and specific…
What Can Quantum Computers Actually Do in 2026?
Less than the briefings suggest, but more than the sceptics acknowledge. This article works through the hardware landscape as it stands in 2026,…
How to Include Post-Quantum Cryptography Requirements in a Quantum Security Insurance Review
Underwriter questionnaires are beginning to incorporate quantum security posture into risk assessment. This article maps what a credible answer looks…
Quantum Security CPD: How UK and EU Security Professionals Build a Recognised Portfolio
NIST published FIPS 203, 204, and 205 in August 2024. DORA entered full enforcement in January 2025. The regulatory infrastructure exists. The CPD…
How to Calculate Your Organisation's HNDL Exposure
Harvest-now-decrypt-later exposure is calculable, not qualitative. An organisation that knows its network topology, data retention requirements, and…
The PQC Readiness Checklist Every CISO Should Run Through
Post-quantum cryptography readiness has a specific structure. Six areas must all advance for a migration to succeed: cryptographic discovery,…
Quantum Error Correction Explained: What It Means for the Q-Day Timeline
Google's Willow chip in December 2024 confirmed below-threshold quantum error correction in hardware for the first time. Understanding what it…
NCSC PQC Migration Guidance: The UK Position Explained
On 20 March 2025 the NCSC published its first dedicated PQC migration timeline, setting milestones at 2028, 2031, and 2035. For operators of essential…
EU Quantum Security Policy 2026: What the Regulations Require
There is no single EU quantum security regulation. There is instead a cluster of four general cybersecurity instruments whose requirements for…
How DORA Shapes Quantum Security Preparedness in Financial Services
DORA's ICT risk management obligations are live. This article maps the specific Articles 6 and 9 obligations and their RTS implementations to…
ETSI Quantum Safe Cryptography Standards: A Guide for European Organisations
For organisations operating in the EU, ETSI standards are not an alternative to NIST — they are the regulatory translation layer. This article maps…
The CISO's Case for Quantum Security Investment in 2026
The board case for PQC investment changed materially in August 2024 when NIST published final standards and opened the deprecation clock. This article…
Long-Lived Data and Quantum Risk: What to Protect First
Not all data needs migrating at the same urgency. This article applies the Mosca inequality to specific data categories with specific confidentiality…
What the EU Cyber Resilience Act Means for Quantum-Vulnerable Products
The EU Cyber Resilience Act's main conformity obligations apply from December 2027. For manufacturers whose products use quantum-vulnerable…
Why Your GDPR Data Retention Schedule Needs a Post-Quantum Review
The obligation to protect personal data with measures 'appropriate to the risk' under UK GDPR Article 32 includes the current threat model. That model…
Quantum Computing Progress in 2026: IBM, Google, and the Race to Fault Tolerance
Google's Willow chip and IBM's Nighthawk processor are genuine scientific milestones. Neither changes the 2033-2035 Q-Day central estimate.…
Quantum Security Training Programmes: What a Rigorous Curriculum Should Cover
Available quantum security training clusters at opposite extremes: PhD-depth theory with no migration connection, or awareness briefings that explain…
How to Build a Cryptographic Asset Register for Your Organisation
The most common reason PQC migration programmes stall at planning is the absence of a reliable answer to one question: what cryptographic assets do we…
Vendor Selection for PQC Migration: How to Evaluate Cryptographic Library and Platform Providers
A cryptographic library is not a commodity procurement. Choose a library without ML-KEM support today and you face a choice between deferring…
PQC Compliance Readiness: A Gap Analysis Framework for Security Teams
Multi-framework PQC compliance is the problem most organisations face in 2026. NIST IR 8547, CNSA 2.0, DORA, and NIS2 share a technical foundation but…
HNDL Risk Assessment Framework for Enterprise Security Teams
The Harvest Now, Decrypt Later attack is not a theoretical concern for 2033. The interception is happening now. A five-component operational framework…
Quantum Security for OT and SCADA Systems: A Practitioner's Assessment Framework
The PQC migration problem in operational technology environments is harder than in IT. Hardware cycles of ten to twenty years, compute-constrained…
Zero Trust and Post-Quantum Cryptography: Why One Without the Other Is Not Enough
Zero Trust Architecture removes implicit network trust. Post-quantum cryptography migration removes algorithm vulnerability to a future quantum…
Stay Informed
Subscribe to the QSECDEF newsletter for weekly updates on quantum security, new lecture recordings, and upcoming events.
Subscribe to Newsletter