Cybersecurity

Post-Quantum Cryptography Readiness with ITSEC

Discover how ITSEC helps organisations prepare for the post-quantum era with future-proof cryptography and cyber resilience strategies.

ITSEC Asia

Jul 11, 2025

Post-Quantum Cryptography Readiness with ITSEC

For decades, public-key cryptography has been the backbone of protecting sensitive information, such as financial transactions, personal data, corporate communications, and government secrets. Whether logging into a secure banking app, shopping online, or browsing encrypted websites (like HTTPS), public key infrastructure (PKI) protects your data from cybercriminals. However, the rise of quantum computing introduces transformative and potentially disruptive challenge to this foundation of digital trust.

The Quantum Revolution

Quantum computers can perform complex computations faster than even the most advanced current supercomputers. While this capability promises breakthroughs in drug discovery and healthcare, materials science or Artificial Intelligence (AI), it also poses a significant threat to current cryptographic systems. Quantum computers could break widely used publickey cryptographic systems (e.g., RSA, ECC), compromising critical infrastructure security such as energy grids, financial systems, and sensitive government communication networks.

Compromised public-key cryptography could lead to forged digital certificates or signatures, undermining trust in banking, healthcare, and government services. Quantum cryptography attacks could also compromise billions of connected devices, from smart homes to Industrial Control Systems (ICS), by breaking traditional encryption used in secure communication.

Furthermore, cyber criminals and government adversaries could use “harvest now, decrypt later” attacks, where adversaries collect encrypted data today for decryption when quantum computers become available. This could affect all the critical infrastructure, which also often handles sensitive data with long-term confidentiality needs (e.g. medical records, state secrets). Experts predict that “Q-Day”, when quantum computers crack current encryption, may arrive within a decade. This has spurred global efforts to develop and implement post-quantum cryptography, new encryption algorithms designed to resist quantum attacks.

Global Efforts to Prepare for Post-Quantum Cryptography

Governments worldwide are already taking proactive steps to counter the threats of Quantum Computing to cybersecurity. In the US, the Quantum Computing Cybersecurity Preparedness Act (H.R.7535), signed into law on December 21, 2022, as Public Law 117-260, aims to encourage federal agencies to migrate their information technology systems to post-quantum cryptography (PQC) to protect against future quantum computing threats. It mandates agencies to assess vulnerabilities, maintain inventories of quantum-vulnerable systems, and develop strategies for PQC adoption.

Furthermore, the Cybersecurity and Infrastructure Security Agency (CISA) launched a PQC Initiative in July 2023 to support critical infrastructure with risk assessments and transition planning. CISA has provided resources for cryptographic inventorying and testing PQC algorithms, indicating ongoing compliance efforts with H.R.7535.

The National Institute of Standards and Technology (NIST) finalised three PQC standards (FIPS 203, 204, 205) on August 13, 2024. A fourth standard (HQC) was selected for standardisation on March 11, 2025. NIST encourages immediate transition to these standards.

The US National Security Agency mandates PQC for software and firmware updates by 2025. By 2030, all cryptographic systems within the scope of CNSA 2.0 must exclusively use PQC algorithms, phasing out legacy algorithms (e.g., RSA, ECC) vulnerable to quantum attacks.

In the European Union, the Commission Recommendation (EU) 2024/1101, adopted on April 11, 2024, urges EU Member States to develop consistent strategies for adopting PQC to secure digital infrastructures and services in public administrations and critical infrastructure. Southeast Asia’s first National Quantum-Safe Network Plus (NQSN+) was launched in Singapore in 2023 as part of Singapore’s Digital Connectivity Blueprint. NQSN+ aims to build a quantum-safe communication infrastructure by 2030. It combines PQC, which upgrades software with quantum-resistant algorithms, and Quantum Key Distribution (QKD), a hardwarebased approach for secure key sharing.

In 2024, the Monetary Authority of Singapore (MAS) and Banque de France conducted a groundbreaking PQC experiment, successfully using quantum-resistant (PQC) algorithms (CRYSTALS-Dilithium and CRYSTALS-Kyber) to sign and encrypt email. In 2024, MAS also issued an advisory (MAS/TCRS/2024/01) urging financial institutions to prepare for quantum risks by maintaining cryptographic inventories, conducting risk assessments, and adopting PQC solutions.

Singapore is also monitoring progress on NIST post-quantum cryptography and set to roll out its own standard from 2025. (reference: https://www.reedsmith.com/en/perspectives/2024/12/csa-to-roll-out-quantum-security-guidelines-from-2025)

Meanwhile, Indonesia’s PQC efforts are in early stages compared to Singapore’s more structured initiatives. In May 2025, the Indonesian Defense University (Unhan RI) inaugurated the Center for Quantum Security Ecosystem (CQSE), and, at the same event, released a Quantum-Security Roadmap 2025-2030: Phase 1 (2025-27), creating a joint Unhan, BRIN, BSSN and TNI research hub and pilots of Quantum VPN for secret government and military communications. Phase 2 (2027- 30) extends post-quantum cryptography and quantum-key-distribution across the national strategic network.

The Quantum Revolution

PT ITSEC Asia Tbk (CYBR), a leading cybersecurity firm listed on the Indonesian Stock Exchange, is pioneering the integration of post-quantum cryptography (PQC) solutions and research in Indonesia and the Asia Pacific region

ITSEC’s PQC Strategy Includes:

Research and Testing

Partnering with global tech firms and academic institutions, ITSEC develops PoCs to validate PQC algorithms and solutions such as Quantum Entropy Appliances, Quantum Entropy-as-a-Service, and Digital Quantum Key Distribution (DQKD) products. ITSEC conducts controlled PoC implementations to showcase PQC integration in real-world applications like secure communications, financial transactions, and data storage.

Training and Capacity Building

Through ITSEC Cyber Academy, launched in 2025, ITSEC offers PQCfocused training tied to PoC outcomes, equipping Indonesian IT professionals with skills to adopt quantum-safe standards.

Industry Awareness

ITSEC promotes PQC through PoC demonstrations at industry forums, media, and conferences (e.g., ITSEC Cybersecurity Summit 2025), highlighting the need for quantum readiness

ITSEC’s PQC efforts align with Indonesia’s growing effortsin quantum-safe cybersecurity.

Share this post

AI Penetration Testing vs Traditional Penetration Testing: What's the Difference?

Organizations today face an increasingly complex threat landscape. New vulnerabilities emerge daily, attack surfaces expand continuously and attackers are leveraging automation to move faster than ever before. For many years, traditional penetration testing has been an essential part of cybersecurity programs. However, as environments become more dynamic, many organizations are exploring how artificial intelligence can enhance security assessments and provide more continuous visibility. This shift has given rise to AI penetration testing. But how does AI powered penetration testing compare to traditional penetration testing? Is AI replacing ethical hackers, or are the two approaches designed to work together? UNDERSTANDING TRADITIONAL PENETRATION TESTING Traditional penetration testing involves security professionals simulating real world attacks to identify vulnerabilities and weaknesses before attackers can exploit them. HOW TRADITIONAL PENETRATION TESTING WORKS A typical penetration testing engagement may include: * Reconnaissance and information gathering. * Vulnerability identification. * Exploitation and attack path analysis. * Privilege escalation testing. * Manual validation of findings. * Reporting and remediation recommendations. Traditional penetration testing provides deep insights into an organization's security posture

ITSEC Asia

Jun 15, 2026 — 5 minutes read

Cybersecurity

What Is Continuous Security Validation and Why Does It Matter?

Cyber threats evolve continuously. New vulnerabilities are discovered every day. Cloud environments change rapidly. Applications are updated frequently. Employees adopt new technologies and attackers constantly search for opportunities to exploit weaknesses. Yet many organizations still rely on periodic security assessments conducted once or twice a year. The challenge is simple: risk does not wait for the next penetration test. This is why more organizations are embracing Continuous Security Validation (CSV) as part of a modern cybersecurity strategy. WHAT IS CONTINUOUS SECURITY VALIDATION? Continuous Security Validation is the practice of continuously evaluating and validating an organization's security posture as environments, threats and attack surfaces evolve. Instead of providing a snapshot at a single point in time, Continuous Security Validation delivers ongoing visibility into security weaknesses and control effectiveness. Its purpose is to answer a critical question: "Are our defenses still working today?" Rather than waiting months between assessments, organizations gain a more dynamic understanding of their exposure. WHY TRADITIONAL ASSESSMENTS ARE NO LONGER ENOUGH Traditional penetration testing remains an important component of cybersecurity. However, most assessments are performed

ITSEC Asia

Jun 15, 2026 — 4 minutes read

Cybersecurity

API Security Testing: Why APIs Have Become a Prime Target for Attackers

Modern applications rarely operate in isolation. From mobile apps and cloud platforms to payment gateways and third-party integrations, APIs (Application Programming Interfaces) have become the invisible backbone of digital services. Organizations rely on APIs to connect systems, exchange data and accelerate innovation. Unfortunately, attackers rely on them too. As API adoption continues to grow, APIs have emerged as one of the fastest-growing attack surfaces in cybersecurity. Misconfigured or vulnerable APIs can expose sensitive information, disrupt business operations and provide attackers with a direct path into critical systems. This is why API Security Testing has become an essential part of modern application security. WHAT IS API SECURITY TESTING? API Security Testing is the process of identifying and validating vulnerabilities within APIs before they can be exploited by malicious actors. Unlike traditional web application testing, API security assessments focus on how applications communicate with each other and whether those interactions can be manipulated or abused. The objective is not simply to find vulnerabilities but to understand how weaknesses within APIs could impact business operations and data security. WHY

ITSEC Asia

Jun 15, 2026 — 5 minutes read

Post-Quantum Cryptography Readiness with ITSEC

The Quantum Revolution

Global Efforts to Prepare for Post-Quantum Cryptography

The Quantum Revolution