Logo
Cybersecurity

You Don’t Need to Be a Cryptographer to Start Preparing for Post Quantum Security

The first workforce challenge isn’t inventing a new algorithm. It’s finding every place the old ones are hiding.

ITSEC AsiaITSEC Asia
|
Sep 29, 2026
You Don’t Need to Be a Cryptographer to Start Preparing for Post Quantum Security

Ask a security team where the organization uses cryptography and the first answers will probably be obvious: TLS certificates, VPNs, encrypted databases and authentication systems.

Then keep asking.

What about APIs? Code signing? SSH? Embedded devices? Software libraries? Cloud services? Machine identities? Third party applications?

The list gets longer rather quickly.

That matters because NIST is now telling organizations to begin migrating toward post quantum cryptography. Its first three finalized PQC standards have been available since 2024, and NIST says products, services and protocols will need updates as organizations move away from quantum vulnerable public key algorithms. NIST

The workforce problem starts before anyone changes an algorithm.

First, Find the Cryptography

NIST’s Migration to Post Quantum Cryptography project describes cryptographic inventory as a record of cryptography used across systems, applications, services, devices and data flows. It can include algorithms, protocols, keys, certificates and the components that depend on them. NIST Pages

Building that inventory requires more than a specialist who understands the mathematics behind ML-KEM or ML-DSA.

Organizations need people who can:

  • Identify cryptography embedded in applications and infrastructure
  • Understand TLS, SSH, VPNs, certificates and digital signatures
  • Trace which business systems depend on particular cryptographic services
  • Assess how long sensitive data must remain protected
  • Work with application owners and technology suppliers
  • Test whether replacement mechanisms remain interoperable
  • Prioritize migration according to risk

Suddenly post quantum readiness looks much more like an engineering and asset visibility problem.

Migration Crosses Team Boundaries

Consider a certificate used by an internal application.

Changing its cryptography may affect the application, identity infrastructure, operating system, network components and other systems that trust the certificate. Older devices may not support the replacement. Performance characteristics may change. A third party dependency might sit somewhere in the chain.

NIST’s June work on post quantum updates for Personal Identity Verification illustrates this transition problem. Its proposed approach includes a dual stack model, retaining existing classical credentials while introducing PQC capabilities to support backward compatibility and gradual deployment. NIST

That’s migration work, not a simple software update.

The people doing it need to understand dependencies, testing and change management alongside security.

Put Cryptographic Discovery Into Training

A useful PQC exercise doesn’t have to begin with advanced mathematics.

Give learners a simulated enterprise containing web applications, certificates, VPN connections, code signing, APIs and several older systems. Ask them to build a cryptographic inventory.

Then introduce a migration requirement.

Which systems should move first? Which dependencies create risk? Where is cryptography controlled internally and where does the organization depend on another provider? What needs to be tested before anything changes?

This is where practical training becomes useful. At ITSEC Cyber & AI Academy, hands on cybersecurity environments can help professionals connect emerging subjects such as post quantum security with the infrastructure, risk and operational decisions they already encounter.

Quantum computing may be an advanced field.

Preparing an organization for it begins with a much more familiar cybersecurity skill: knowing what you actually have.

Explore practical cybersecurity and AI training at ITSEC Cyber & AI Academy.

References: NIST: Post Quantum Cryptography · NIST NCCoE: Migration to Post Quantum Cryptography FAQ · NIST: Post Quantum Updates to PIV Standards · ITU Academy: Quantum Communications and Post Quantum Cybersecurity, 14 September–2 October 2026

Share this post

You may also like

Data Protection and Cybersecurity Laws in the Asia-Pacific Region
Cybersecurity

Data Protection and Cybersecurity Laws in the Asia-Pacific Region

Info

Apart from sales and trade, the majority of internet users utilize it for socializing and interacting with peers online. For instance, there were 3.8 billion social media users in January 2020, which represents a 9 percent increase from the previous year. The advancements in internet and related communication technologies enable easy access to information from anywhere on the planet. For example, an online merchant operating in Thailand can offer their services to customers residing in the European Union and the United States. In order to address the dissemination of personal information, including financial, medical, and other types of personal data, worldwide through the internet, appropriate legal regulations need to be established to protect the personal data of citizens and the digital assets of organizations while working online. Following the implementation of the General Data Protection Regulation (GDPR) in the European Union (which came into effect on May 25, 2018), which governs data protection and privacy in EU countries and regulates the transfer of personal data outside the European Union and

ITSEC AsiaITSEC Asia
|
Jul 10, 2023 — 11 minutes read
Entry-Level Cybersecurity Is Getting a New Job Description
Cybersecurity

Entry-Level Cybersecurity Is Getting a New Job Description

There used to be a fairly predictable starting point for a cybersecurity career. Learn networking. Understand access control. Get comfortable with security operations. Then, after some experience, start tackling the newer and more complicated stuff. AI is messing with that sequence. On 1 September 2026, ISC2 introduced its updated Certified in Cybersecurity exam outline, the first major content revision since the entry-level certification launched in 2022. Foundational AI concepts are now integrated into the material, including identifying AI assets, recognizing automated threats and supporting secure governance of emerging technologies. Its updated AI guidance goes further. Cybersecurity professionals increasingly need competence in AI governance, model security, data integrity, prompt engineering, AI risk management and the security of AI-enabled systems. That’s quite a list for something that was recently considered a specialist topic. AI SECURITY IS MOVING DOWN THE CAREER LADDER There’s a practical reason for this. AI-enabled systems are entering everyday business operations. At the same time, AI can be used for phishing, social engineering and increasingly automated attacks. Indonesia is already preparing for that reality.

ITSEC AsiaITSEC Asia
|
Sep 03, 2026 — 3 minutes read
OWASP Top 10 Explained: The Risks Every Organization Should Understand
Cybersecurity

OWASP Top 10 Explained: The Risks Every Organization Should Understand

Modern applications have become increasingly interconnected and complex. Organizations rely on web applications, APIs and cloud services to support critical business operations and deliver digital experiences. Unfortunately, attackers are evolving just as quickly. As cyber threats continue to grow, understanding common application security risks has become essential. This is where the OWASP Top 10 plays an important role. Widely regarded as one of the most influential resources in application security, the OWASP Top 10 provides organizations with a practical framework for understanding and prioritizing the most critical risks affecting web applications. Whether you are a developer, security professional or business leader, understanding these risks is essential for building stronger cyber resilience. WHAT IS OWASP? OWASP, or the Open Worldwide Application Security Project, is a global non-profit organization focused on improving software security. Among its many initiatives, the OWASP Top 10 is perhaps the most widely recognized. It highlights the most significant security risks affecting modern web applications based on industry data and expert consensus. The list is not intended to be a compliance checklist. Instead,

ITSEC AsiaITSEC Asia
|
Jun 15, 2026 — 5 minutes read

Receive weekly
updates on new posts

Subscribe