Post-Quantum Security Isn't a Someday Topic for Banks - It's a Today Topic

🔐 Quantum computing isn't a 'someday' topic for banks. It's a today topic. Yesterday I spent the day on post-quantum security with a bank and Jonathan Jenkyn. One idea reframed the room: the data you're encrypting today could be exposed tomorrow - or five years from now - when quantum computers reach maturity. The clock has already started ticking. ⏳

The Threat: Harvest Now, Decrypt Later

'Harvest now, decrypt later' - attackers can capture your encrypted data today and crack it once quantum hardware matures.

For a bank, that means account records, transactions, and customer data that must stay private for decades. This isn't theoretical. Harvest Now, Decrypt Later (HNDL) is a real and immediate threat - adversaries are already stealing and storing encrypted data, waiting for the day when quantum capability arrives to unlock it all.

The timeline? Cryptographically relevant quantum computers (CRQCs) are expected to become capable of breaking asymmetric cryptography, potentially within the next decade. That's not a distant horizon - it's a planning window that closes fast.

It's a Today Topic, Not a 2030 One

Your longest-lived data is your most exposed. If you're a financial institution holding records that must remain confidential for 20, 30, or 50 years, the threat window opened the moment that data was encrypted with today's algorithms.

Post-quantum readiness isn't a future-year project. It's a planning priority for 2025 and 2026.

Singapore gets this. The Monetary Authority of Singapore (MAS) has allocated S$100 million specifically for financial sector quantum capabilities, and the National Quantum Strategy allocated nearly S$300 million from the Research, Innovation, and Enterprise 2025 plan. In March 2025, Singapore released draft quantum governance frameworks covering post-quantum cryptography for the financial sector. The regulatory signal is clear: this is infrastructure-level work, not a nice-to-have.

Your AI Footprint Just Widened the Surface

Every LLM and agentic AI workflow moves sensitive data across the wire - prompts, RAG pipelines, agents calling tools and APIs. 🤖

Post-quantum readiness and your AI roadmap are woven into each other. As you scale GenAI and agentic systems, you're expanding the attack surface for harvest-now-decrypt-later threats. The two conversations need to happen in the same room.

Think about it: every prompt sent to a foundation model, every embedding stored in a vector database, every tool call an agent makes to retrieve customer context - all of it is encrypted in transit and at rest. If that encryption can be broken retroactively, your AI systems become a treasure trove for future attackers.

This is where human-first AI thinking matters most. We're not just building faster systems - we're building systems that handle the most sensitive decisions and data in our institutions. Security can't be bolted on later. It has to be woven into the architecture from day one.

Know Your Shared Responsibility

The good news? The standards are here. In 2024, NIST finalized its first Post-Quantum Cryptography standards (FIPS 203-205) based on CRYSTALS-Kyber, CRYSTALS-Dilithium and SPHINCS+. These aren't experimental - they're production-ready algorithms designed to resist quantum attacks.

AWS uses ML-KEM (the new NIST standard) in a hybrid handshake - already live in KMS, ACM, and Secrets Manager. ✅

Some protections are automatic; others need you to update TLS clients and SDKs. Start with a crypto inventory 🔍 - you can't migrate what you can't see.

MAS is leading the way on practical implementation, too. On 29 September 2025, MAS published a technical report on a Quantum-Safe Sandbox for the financial sector, highlighting that quantum key distribution (QKD) has strong potential for securing sensitive data exchanges in finance. Real pilots, real learnings, real timelines.

Here's where to start:

• 🔹 Identify your longest-lived data - what must stay private for decades?
• 🔹 Map your AI data flows - where do prompts, embeddings, and tool calls travel?
• 🔹 Audit your cryptographic dependencies - which libraries, SDKs, and services need updates?
• 🔹 Plan your migration timeline - hybrid approaches let you transition without ripping and replacing.

You can read more in the AWS post-quantum cryptography overview.

The Planning Starts Today

🙏 Grateful to the bank's security and engineering team for the sharp questions and discussions. This is a multi-year journey - but the planning starts today.

The teams starting now will be the calm ones when the timeline tightens. 🚀

What I love about this work is that it's fundamentally about stewardship. We're protecting not just today's customers, but the trust and privacy of people whose data will outlive the systems we're building right now. That's the kind of long-term thinking that separates resilient institutions from reactive ones.

Is post-quantum readiness on your 2026 security and AI roadmap yet? I'd love to hear where you are in the journey.

#AlwaysDay1 #PostQuantumCryptography #AgenticAI #CyberSecurity #FinancialServices #CloudSecurity #AISecurity