Commentary on Post-Quantum Cryptography Readiness and Gaps in End-to-End Encrypted Messaging
Security commentary highlighted that end-to-end encryption (E2EE) has materially improved privacy in mainstream messaging, but important gaps remain—especially where plaintext or recoverable ciphertext is reintroduced via cloud backups and multi-party backup chains. The discussion pointed to Apple’s iMessage ecosystem as an example where E2EE can be undermined if device backups are not protected with Advanced Data Protection (ADP), and noted uneven progress across platforms on post-quantum resilience (e.g., Signal and Apple cited as having post-quantum protections, while Android messaging protocols were described as not yet upgraded).
Separate industry perspective argued organizations should accelerate post-quantum cryptography (PQC) planning due to the long lead time required for migration and the risk of “harvest now, decrypt later” collection by sophisticated adversaries. It emphasized that guidance from NIST and CISA has shifted toward urgency, warned that widely used public-key cryptography (e.g., RSA/ECC) faces future quantum risk, and described practical blockers such as building a usable cryptographic inventory at scale—where common discovery approaches (like certificate scanning) miss embedded and non-obvious cryptographic dependencies.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
6 events from the most recent confirmed update back to the earliest known activity.
Forecast says quantum systems may break RSA and ECC by 2029
The SC Media article reports a projected milestone that by 2029 quantum computing will likely be capable of breaking widely used RSA and ECC cryptography, compressing enterprise migration timelines.
Android 17 enables Certificate Transparency by default
The Feisty Duck newsletter reports that Android 17 turns on Certificate Transparency by default, marking a platform security change affecting certificate validation and ecosystem visibility.
Let's Encrypt reports ACME changes
The newsletter notes changes in the Let's Encrypt ACME ecosystem as part of broader PKI and certificate-management developments relevant to secure communications.
IETF advances work on post-quantum certificates
The Feisty Duck newsletter reports ongoing IETF work related to post-quantum certificates, reflecting technical ecosystem progress toward PQC-ready PKI.
Experts warn adversaries are harvesting encrypted data for future decryption
The SC Media piece says sophisticated adversaries are already collecting encrypted data now with the expectation that future quantum capabilities will let them decrypt it later, increasing the urgency of crypto modernization.
NIST, CISA, and Gartner shift to urgent PQC migration warnings
Guidance cited in the references indicates major standards and security bodies have moved from long-term planning to urging organizations to begin post-quantum cryptography migration immediately because the risk timeline has accelerated.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
2 references tracked. Mallory keeps watching after this page renders.
See the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Post-Quantum Cryptography Transition Planning to Mitigate “Harvest Now, Decrypt Later” Risk
Organizations are accelerating **post-quantum cryptography (PQC)** planning amid concerns that adversaries are already conducting “**harvest now, decrypt later**” operations—collecting encrypted traffic today for future decryption once sufficiently capable quantum computers emerge. A supply-chain-focused analysis highlighted that procurement and third-party ecosystems often rely on long-lived trust anchored in **RSA** and **ECC**, and that sensitive data exchanged across supplier onboarding, invoicing, contracts, pricing, and banking workflows could be exposed retroactively if captured now and decrypted later. A U.S. State Department cybersecurity official urged tighter **public-private coordination** on PQC migration, framing quantum resilience as an ecosystem-wide modernization effort rather than isolated upgrades by individual organizations. The official emphasized that adversaries (including **China**) can target entire digital ecosystems, and argued that transition plans must account for long-term national security risks such as data harvesting, with modernization efforts designed to reduce predictability and strengthen collective defenses across interconnected systems, devices, and data flows.
Jun 30, 2026
Post-Quantum Cryptography Planning for Identity and Machine-to-Machine Security
Security teams are accelerating **post-quantum cryptography (PQC)** planning as quantum computing threatens widely used public-key algorithms such as **RSA** and **ECC**, with particular concern for long-lived data and identity systems. Gopher Security argues that AI-agent identity and authorization flows—especially those relying on asymmetric signatures (e.g., **JWT** signing) and emerging AI integration patterns like the **Model Context Protocol (MCP)**—could be exposed to “harvest now, decrypt later” collection and future signature-forgery/impersonation risks if organizations delay migration; it also notes that simply increasing symmetric key sizes (e.g., moving to **AES-256**) does not address the asymmetric identity layer. Separately, Europol-coordinated research (as reported by Help Net Security) provides a practical prioritization framework for **financial institutions** to decide where PQC migration should start, combining a **Quantum Risk Score** (based on data “shelf life,” exposure, and business impact) with an estimate of **migration time/complexity** so leadership can sequence upgrades defensibly rather than attempting a “big bang” replacement. Additional Gopher Security material frames the same broader shift as a machine-identity problem—where service accounts, microservices, and automated connections dominate—and emphasizes modern transport protections (e.g., **TLS 1.3**) and stronger integrity/verification approaches for machine-to-machine data access, aligning with the need to modernize cryptographic controls as part of PQC readiness.
Jun 30, 2026
Industry Response to Quantum Computing Threats in Cryptography
The looming threat posed by quantum computers to current cryptographic systems has prompted significant discussion and action within the cybersecurity industry. Experts warn that once quantum computers become powerful enough, they will be able to break widely used encryption algorithms, jeopardizing the security of communications, financial transactions, and sensitive data. Zulfikar Ramzan, CTO of Point Wild, emphasizes that despite substantial investments in traditional cybersecurity tools, organizations remain vulnerable, highlighting the need for robust cryptographic strategies as a core component of cyber resilience. He points out that the transition to quantum-resistant cryptography is complex, involving not only technical challenges but also compliance with emerging standards such as those from NIST. Organizations are being driven toward quantum migration by both the evolving threat landscape and regulatory requirements, but the process is far from straightforward. Many enterprises are still in the early stages of preparing for this shift, with less than half of TLS connections in major networks like Cloudflare supporting quantum-resistant algorithms, and even fewer organizations implementing quantum-ready encryption in less prominent protocols. The uncertainty around the timeline for quantum computing's impact has led to hesitation in investing the necessary resources for a full migration. However, some entities are taking proactive steps. The engineering team behind the Signal Protocol, which powers secure messaging apps like Signal Messenger, has recently completed a major update to make their protocol fully quantum-resistant. This achievement required overcoming significant engineering challenges, given the intricate nature of the existing protocol. The Signal team's work stands out as a rare example of industry leadership in quantum-safe cryptography, contrasting with the broader industry's slow adoption. The update was detailed in a comprehensive technical write-up, underscoring the complexity and importance of the transition. Compliance with new standards, such as those being developed by NIST, is expected to further drive organizations toward adopting quantum-resistant solutions. The shift to post-quantum cryptography is not just a technical upgrade but a fundamental change in how organizations approach data protection. Security leaders are urged to prioritize cryptographic agility and resilience in their long-term strategies. The industry is at a crossroads, balancing immediate threats like ransomware with the existential risk posed by quantum computing. As the timeline for quantum breakthroughs remains uncertain, early adopters like Signal set a precedent for others to follow. The conversation around post-quantum cryptography is intensifying, with experts advocating for a proactive rather than reactive approach. Ultimately, the transition will require coordinated efforts across technology, compliance, and operational domains to ensure the continued security of digital communications and assets.
Jun 30, 2026