Black Kite has integrated new controls into its Cyber Rating, assessing the quantum agility of organizations’ third-party vendors. The company highlights the growing threat of “harvest now, decrypt later” attacks, where adversaries collect encrypted data anticipating future decryption by quantum computers. Experts predict these capable quantum computers could arrive as early as 2028, creating near-term urgency for vendor preparedness. “Third-party cyber risk management needs to account for where risk is going, not only where it exists today,” said Ferhat Dikbiyik, Chief Research & Intelligence Officer at Black Kite.
Black Kite’s Quantum Readiness Evaluates Third-Party Ecosystems
This granular approach moves beyond broad risk assessments by evaluating observable signals of post-quantum cryptographic readiness, including hybrid post-quantum key exchange and certificate signature readiness. The system also flags assets lacking an identified migration path, providing a clear picture of potential vulnerabilities within a vendor’s infrastructure. Regulatory deadlines are accelerating the need for this type of assessment; NIST’s schedule deprecates RSA, ECDSA and ECDH after 2030, with a complete disallowance by 2035.
The U.S. Office of Management and Budget (OMB) M-26-15 mandates post-quantum key establishment for federal agencies by the end of 2030 and digital signatures by 2031, while Executive Order 14412 requires covered contractors to meet NIST post-quantum standards by December 31, 2030. Black Kite’s Quantum Readiness aims to provide organizations with the means to track vendor progress against these evolving requirements and identify potential gaps in their supply chain.
Evaluating quantum agility extends beyond an organization’s internal defenses, according to Black Kite. “Quantum readiness cannot stop at the agency perimeter,” said Megan Rolander, Public Sector Director, Black Kite. Federal agencies, in particular, rely on extensive networks of contractors and technology providers, necessitating a comprehensive understanding of their preparedness for the transition to post-quantum cryptography. Black Kite’s solution provides this visibility, enabling agencies to proactively address risks across their broader ecosystem before regulatory demands become more pressing.
The development responds to the growing threat of sophisticated attacks that anticipate the arrival of quantum computing, the company says. “Cryptographic migrations take years, and sensitive information being transmitted today could remain valuable to attackers long into the future,” explained Konstantinos Karagiannis, Senior Director, Quantum Computing Services, Protiviti.
“Measuring quantum agility provides an important signal of how mature an organization’s security program is and whether they are taking the steps necessary to prepare for the coming quantum era.” Black Kite’s system allows organizations to evaluate preparedness at scale, identifying vendors actively adopting quantum-safe encryption methods or those lagging behind in their preparations, according to the company. The company’s solution is designed to address the inherent uncertainty surrounding the precise timing of “Q-Day,” the point at which quantum computers will be capable of breaking current encryption standards.
Karagiannis stated that “the uncertainty around Q-Day is exactly why organizations need to prepare now.” By providing a detailed assessment of vendor quantum agility, Black Kite aims to empower organizations to mitigate risks and ensure the long-term security of their data and systems.
Third-party cyber risk management needs to account for where risk is going, not only where it exists today.
Ferhat Dikbiyik, Chief Research & Intelligence Officer (CRIO), Black Kite
See today’s quantum computing news on Quantum Zeitgeist for the latest breakthroughs in qubits, hardware, algorithms, and industry deals.
