Securing Trust in Data for the Quantum Era

Across government and industry, organisations are investing heavily in data.

They are investing in legacy system modernisation, enterprise cloud migration and cloud-native data platforms, enabling AI adoption and creating new ways to share information across organisational boundaries. Increasingly, these initiatives form part of wider AI-ready data modernisation programmes designed to create more connected, intelligent and adaptable organisations. Whether the objective is improving public services, accelerating the energy transition, reducing operational costs or creating more intelligent customer experiences, the strategy is remarkably similar; use data more effectively.

As organisations become increasingly dependent on shared data, digital services and AI-driven decision-making, trust becomes part of the infrastructure itself. Much of that trust relies on cryptographic controls that secure identities, data exchanges and access to sensitive information.

Yet one assumption often sits beneath these programmes; that the crypto graphic foundations protecting that data will remain effective for the life time of the systems being built. That assumption is increasingly being challenged.

Post-Quantum Cryptography (PQC) is often discussed as a future cybersecurity issue. In reality, it is becoming a design consideration for any organisation investing in data infrastructure expected to survive the next decade and beyond.

The question is no longer whether quantum computing will impact data platforms. The question is whether today's data platforms are being designed with that future in mind.

Why This Matters Now

One of the reasons Post-Quantum Cryptography has moved from a theoretical concern to a practical one is the emergence of Harvest Now, Decrypt Later (HNDL) attacks.

Adversaries capture encrypted information today with the expectation that future quantum capabilities may allow it to be decrypted years later.

However, HNDL also highlights a broader challenge. For an attacker to decrypt sensitive information in the future, that data must first have been captured and moved beyond the organisation's control.

In a recent Joint Cybersecurity Advisory, issued by the UK's National Cyber Security Centre (NCSC), the US Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), Federal Bureau of Investigation (FBI) and partners including the Australian Signals Directorate (ASD) [1], state-sponsored campaigns targeting telecommunications providers, critical infrastructure and government networks were highlighted as examples of adversaries seeking persistent access to sensitive information at scale. For organisations managing long-lived data, it serves as a reminder that sophisticated adversaries are already investing in the acquisition and retention of information that may remain valuable for decades.

Whilst quantum-resistant cryptography can help reduce future exposure, it does not prevent the initial compromise, nor does it protect data that has already been compromised.

This is why PQC should be viewed as one component of a broader security strategy. Strong identity controls, data governance, Zero Trust principles, security monitoring and operational resilience remain critical. PQC strengthens the protection of data, but it does not replace the need to protect the data itself.

For organisations modernising their data estates, this reinforces the importance of understanding data flows across increasingly connected ecosystems. The greatest challenge is often not protecting individual systems, but maintaining visibility, governance and trust as data moves between platforms, suppliers and organisational boundaries.

A useful way to frame the challenge is through Mosca's Theorem:

‘If the time data must remain confidential, plus the time required to migrate the systems protecting it, exceeds the time until current cryptography can be broken, that data is already at risk.’ [2]

For many government departments, critical infrastructure operators and regulated industries, the protection requirements for sensitive data are measured in decades. Therefore, preparing for PQC becomes a current planning challenge rather than a future technology problem.

The NCSC has recognised this challenge and published clear migration timelines for Post-Quantum Cryptography. Organisations are expected to complete discovery and planning activities by 2028, undertake priority migrations by 2031 and complete migration of systems, services and products by 2035 [3]. These mile stones reflect the reality that PQC migration is not a single upgrade, but a multi-year transformation programme that requires preparation well before quantum threats become operational.

In all cases, the risk is driven not by the age of the system, but by the longevity, sensitivity and value of the data. Effective PQC planning begins with understanding which data matters most and how it is protected so that security investments can be prioritised according to genuine business and operational risk.

The Emerging  Risk in Data Modernisation Programmes

Many organisations are currently building platforms intended to support business operations for the next ten to fifteen years. For Defence and other nationally critical systems, however, operational lifecycles can extend for several decades, increasing the importance of long-term cryptographic resilience.

Whether delivered through legacy to cloud migration programmes, new secure data platforms or wider digital transformation initiatives, these investments often create technology foundations expected to remain in service for a decade or more.

This places their life span within anticipated post-quantum migration timelines and turns PQC into a present-day architectural consideration.

Decisions being made now around identity services, certificates, key management, API security, integration patterns and supplier technologies will directly influence how difficult, expensive and disruptive future migration becomes.

In my experience, the most difficult aspect of cryptographic change is rarely the algorithm itself. The challenge is understanding where cryptography has become embedded across applications, integrations, supplier technologies and operational processes over many years.

For organisations modernising their data estates, these capabilities form part of the underlying trust architecture that enables secure data sharing at scale.

Organisations that treat PQC as a future security concern risk missing a broader architectural challenge; ensuring today's data platforms can adapt to tomorrow's cryptographic requirements.

Why Government Faces a Particular Challenge

Whilst every sector is affected, government faces a unique combination of pressures.

Across the UK public sector, organisations are simultaneously trying to improve data sharing, accelerate AI adoption and strengthen cyber resilience. Whether through regulated data platforms, modern digital services - government data initiatives, each of these ambitions depends on digital trust.

Government manages some of the country's most sensitive and long-lived data assets, from healthcare and justice records to defence and critical infrastructure data. At the same time, data increasingly flows across departmental and organisational boundaries to deliver more joined-up services.

Importantly, greater data sharing does not have to mean greater risk. The challenge is not how to share less data, but how to share data securely, with clear ownership, governance and accountability.

As data becomes more connected and more widely shared, confidence in its authenticity, integrity and provenance becomes as important as its confidentiality. For government, Defence and critical national infrastructure, this is not simply a cyber security concern. It is fundamental to operational resilience, mission continuity and maintaining confidence in the information used to support critical decisions.

Post-Quantum Cryptography therefore intersects directly with many of the UK's wider digital ambitions.

It is not a standalone security initiative operating alongside transformation. It is increasingly becoming a dependency for transformation itself.

Where the Challenge Really Exists

When organisations think about quantum risk, they often focus on encrypted databases and stored information.

In practice, the bigger challenge is frequently the trust architecture surrounding the data.

Whether operating a secure cloud architecture, a hybrid cloud architecture or an on-premises environment, organisations need visibility of how cryptography is embedded throughout their technology estate.

Cryptography is embedded throughout modern data estates across:

·      API security and system-to-system communication

·      Identity and access management platforms

·      Certificates and digital signatures

·      Key management services

·      Enterprise data integration, data sharing and interoperability platforms

·      Cloud services and supplier ecosystems

The challenge is not the encryption itself, but understanding where cryptography is embedded and how easily it can be adapted. Many organisations cannot confidently identify which systems, services or suppliers would be affected by cryptographic change, making migration harder to plan, prioritise and execute.

This is a challenge I encounter regularly in large-scale transformation programmes. Organisations have far more cryptographic dependencies than they realise, particularly across identity services, API integrations, certificates and third-party software.

Without that understanding, migration becomes significantly more complex, costly and risky.

AI Makes the Challenge More Relevant

Many organisations view AI adoption and PQC as separate initiatives.

AI increases the value organisations derive from data whilst deepening reliance on its integrity, authenticity and availability.

In a modern enterprise or government environment, AI models increasingly consume data originating from hundreds of systems, partners and external sources. Healthcare analytics combine clinical, operational and research data from different organisations. Defence and national security systems routinely correlate information from multiple sources to support operational decision-making.

Consider a modern cross-government data platform where information is shared between departments, agencies and partner organisations to support joined-up services and data-driven decision-making. Cryptographic signatures, certificates and trust services are fundamental to verifying the authenticity and integrity of that information before it is consumed by analytics platforms or AI models. As reliance on these capabilities grows, so too does the importance of maintaining confidence in the trust mechanisms that sit behind them.

As these ecosystems become more interconnected, organisations must not only protect sensitive information but also maintain confidence in where data originated, whether it has been altered and whether the systems providing it can be trusted. Digital signatures, certificates and cryptographic trust mechanisms play a fundamental role in establishing that confidence.

As AI becomes increasingly embedded within operational decision-making, confidence in these trust mechanisms becomes increasingly important. PQC is therefore not only about protecting sensitive information, but preserving confidence in the systems that future AI-enabled services will depend upon.

Building Quantum-Ready Data Foundations

For most organisations, the biggest challenge is not the availability of quantum-resistant cryptography.

The first generation of post-quantum cryptographic standards has already been published by the National Institute of Standards and Technology (NIST)[4], whilst the NCSC has published migration guidance and target timelines for organisations undertaking the transition [3].

The challenge now is not identifying replacement algorithms, but understanding where cryptography is used, how it is embedded and how it can be upgraded without disrupting critical services.

Crypto-agility, the ability to identify, manage and replace cryptographic controls without disrupting services, is becoming increasingly important.

In practice, many organisations still rely on architectures where cryptographic services are tightly coupled to individual applications. Identity services, certificates, key management functions and trust relationships are often distributed across platforms, supplier products and bespoke integrations, making change difficult to coordinate.

A common example I encounter is Public Key Infrastructure (PKI). In many organisations, certificates, trust stores and identity services are deeply embedded across applications and infrastructure. As a result, even relatively small cryptographic changes can have far-reaching operational impacts.

Organisations that centralise trust services, such as identity platforms, certificate management and API security, are typically better positioned to adopt new cryptographic standards. Separating these capabilities from the applications and data products that rely on them improves governance, reduces complexity and makes future cryptographic transitions significantly easier to manage.

At Aker Systems, we see PQC as part of a broader challenge facing organisations modernising their data estates. Our approach combines deep data platform expertise, strong governance and secure-by-design architecture to build secure, resilient and adaptable platforms.

This includes treating data as a product, with clear ownership, governance and quality controls, whilst centralising services such as identity, cryptography and security rather than embedding them within individual applications. This architectural separation allows security controls to evolve independently of the applications they protect, significantly reducing the complexity of future cryptographic transitions.

The benefits extend well beyond PQC, creating more adaptable technology estates, reducing migration risk and embedding trust within the platform rather than treating it as a downstream compliance activity.

Protecting The Future

For organisations responsible for data platforms, the more important question is whether today's systems can adapt when that moment arrives.

The real risk is continuing to build long-lived data platforms on cryptographic assumptions we already know will need to change.

The organisations that succeed will be those that use today's modernisation programmes to build flexibility, visibility and adaptability into their data estates.

Post-Quantum Cryptography is not simply about replacing algorithms, Itis about ensuring that trust in data can evolve alongside the platforms, services and technologies that rely on it.

The NCSC has already set out key milestones for migration, calling for organisations to complete discovery and planning activities by 2028, undertake priority migrations by 2031 and complete migration by 2035 [3].

For many organisations, particularly those responsible for critical services, national infrastructure and long-lived sensitive data, the challenge is not simply adopting new cryptographic standards. It is understanding where cryptography is used, which data assets require long-term protection and how future migration can be aligned with existing modernisation programmes.

The standards exist. The guidance has been published. The timelines have been set.

The organisations best positioned for the quantum era will be those that use today's data modernisation efforts to build the visibility, governance and architectural flexibility needed for tomorrow's cryptographic transition. Those foundations are not built during a migration programme. They are built long before one begins .

‍References:

[1] Joint Cybersecurity Advisory, PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Telecommunications Infrastructure, published by CISA, NSA, FBI, NCSC, ASD and international partners.

[2] Michele Mosca, Cybersecurity in an Era with Quantum Computers: Will We Be Ready? and subsequent work describing Mosca's Theorem (X + Y > Z).

[3] National Cyber Security Centre (NCSC), Timelines for Migration to Post-Quantum Cryptography. Key milestones include:

·      Discovery and planning by 2028

·      Priority migration activities by 2031

·      Migration completion by 2035

[4] National Institute of Standards and Technology(NIST), Post-Quantum Cryptography Standards:

ML-KEM (FIPS 203)

ML-DSA (FIPS 204)

SLH-DSA (FIPS 205)