> 🎙️ This post was auto-generated from the [Tech Updates podcast](https://rss.com/podcasts/tech-updates-by-andres-sarmiento/2915596) episode.


    Quantum computers aren't a distant sci-fi threat anymore — they're arriving in the next decade, and adversaries are already harvesting your encrypted traffic today to decrypt later. If your organization hasn't started planning a post-quantum migration, you're running out of time to act.

What This Episode Covers

  • The three NIST-standardized post-quantum cryptographic algorithms (ML-KEM, ML-DSA, SLH-DSA) finalized in August 2024
  • “Harvest now, decrypt later” attacks and why data encrypted today is already at risk
  • Updated threat timelines: quantum-capable code-breaking computers may arrive within a decade
  • Cisco’s real-world rollout schedule and quantum-safe commitments
  • How post-quantum cryptography maps to core networking concepts (IPsec, TLS, PKI, SD-WAN)
  • A practical 4-step playbook to start your organization’s migration this week
  • Why migrating now is the right choice, even if quantum threats delay

Deep Dive

The “Harvest Now, Decrypt Later” Problem

The biggest conceptual shift in this episode is understanding that the quantum threat isn’t future-proof. Right now, sophisticated adversaries are collecting and storing encrypted traffic—VPN sessions, API calls, confidential communications—knowing they can’t decrypt it today. But the moment a quantum computer capable of breaking RSA and elliptic curve cryptography becomes operational, all that archived data becomes readable.

This isn’t hypothetical. Data encrypted today with standard algorithms like RSA-2048 or ECDP-256 remains sensitive for years or decades. Financial records, healthcare data, intellectual property, government communications—all vulnerable to retrospective decryption. If your organization has been transmitting sensitive information over the past five years, assume it’s already been collected.

The NIST Standards: ML-KEM, ML-DSA, SLH-DSA

In August 2024, NIST finalized three post-quantum cryptographic standards after years of rigorous testing:

ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism) replaces Diffie-Hellman and elliptic curve key exchange. It’s the foundation for quantum-safe TLS handshakes and IPsec key establishment. For network engineers, this is critical: it affects how your VPN concentrators, firewalls, and load balancers negotiate encryption.

ML-DSA (Module-Lattice-Based Digital Signature Algorithm) replaces RSA and ECDSA signatures. This affects certificate validation, code signing, and authentication across your infrastructure.

SLH-DSA (Stateless Hash-Based Digital Signature Algorithm) provides an alternative signature mechanism, useful in specific high-assurance contexts.

All three are based on lattice mathematics—problems so computationally hard that even quantum computers can’t solve them efficiently. Unlike older cryptography, they’re not dependent on the difficulty of factoring or discrete logarithms.

Threat Timeline Reality Check

Last year, experts estimated a 34% probability that a quantum computer capable of breaking encryption would exist within a decade. In 2025, that estimate jumped to 49%—a significant change driven by accelerating quantum research progress and breakthroughs announced by organizations like Google.

The Google quantum research milestone in March 2026 appears to be a pivotal marker in the threat timeline. This isn’t to say a cryptographically-relevant quantum computer (CRQC) is imminent, but the trajectory is clear: waiting is a losing strategy.

Real-World Rollout: Cisco’s Migration Path

The episode provides concrete vendor timelines. Cisco announced:

  • July 2026: Quantum Ready Assessments—helping customers evaluate their current crypto posture
  • August 2026: IOS XE post-quantum cryptography for SD-WAN deployments
  • Later in 2026: Default quantum-safe secure boot and majority of portfolio updates

For network teams, this means your vendor roadmaps are finally aligning with the threat. But it also means procurement timelines compress. You’ll need to plan upgrades within the next 18-24 months, not years.

Post-Quantum Cryptography in Your Network

If you’re studying for Network+, post-quantum cryptography affects multiple core topics:

  • IPsec VPNs: Key exchange and integrity checking will migrate to post-quantum algorithms
  • TLS Handshakes: HTTPS, API encryption, and remote access all depend on key exchange and signatures
  • PKI and Certificates: Digital signatures, certificate chains, and certificate authorities all need post-quantum alternatives
  • SD-WAN: Modern SD-WAN architectures rely on IPsec and TLS for overlay encryption

The migration isn’t a rip-and-replace event. Most organizations will run hybrid crypto—supporting both classical and post-quantum algorithms during the transition period (often called “crypto-agility”).

The Honest Case for Migration

One refreshing aspect of this discussion: the episode doesn’t oversell the quantum threat. Even if a cryptographically-relevant quantum computer never arrives, migrating to post-quantum cryptography has real benefits:

  • Resilience against algorithm breaks: Post-quantum algorithms are mathematically distinct; if one fails, you have alternatives
  • Future-proofing: Equipment purchased today should remain secure for 10-15 years
  • Regulatory compliance: NSM-10, NSA CNSA 2.0, and emerging EU standards are already mandating post-quantum migration timelines

Migration is worth doing even in a world where quantum computers never become practical.

Key Takeaways

  • Start assessments now: Use vendor tools like Cisco’s Quantum Ready Assessments to catalog which systems use cryptography
  • Prioritize data sensitivity: Focus first on systems protecting the most sensitive or long-lived data
  • Plan for hybrid crypto: Most migrations will run both classical and post-quantum algorithms during transition periods
  • Understand your vendor roadmap: Cisco and other vendors are shipping post-quantum support through 2026; align your procurement accordingly
  • Factor this into network upgrades: When refreshing VPN concentrators, firewalls, or SD-WAN controllers, specify post-quantum-capable models

Why This Matters

Post-quantum cryptography is no longer a theoretical exercise or a compliance checkbox for government contractors. It’s a practical engineering problem that every network team will face within the next 24-36 months. Your current encryption—the VPN traffic, the API calls, the cloud backups—is already being collected by adversaries betting on future quantum computers.

The gap between threat timelines and deployment cycles is narrow. Planning

    ---

    🎧 Listen to the full episode on [Tech Updates](https://techupdates.it-learn.io) or wherever you get your podcasts.