Adversaries are already intercepting encrypted communications with the intent of decrypting them later using future quantum computers, according to SpecterAI Quantum Security Chairman APAC Dr. Peter Huynh. Speaking at HPT D-DAY 2026, Huynh explained this “harvest now, decrypt later” approach means the threat to current encryption isn’t theoretical. Vulnerable RSA and elliptic-curve cryptography, which secure TLS and transaction signing, are primary targets, while the U.S. National Institute of Standards and Technology has standardized ML-KEM, ML-DSA and SLH-DSA as replacements.
SpecterAI’s Five Stages to Quantum-Safe Security Readiness
SpecterAI’s five-stage framework for quantum-safe security readiness prioritizes independent validation as the final, critical step for organizations, according to Dr. Peter Huynh. He detailed the process at HPT D-DAY 2026, emphasizing that internal teams building and configuring systems are inherently unable to accurately assess their own quantum resistance.
This approach begins with a comprehensive cryptographic inventory, extending beyond typical network defenses to include often-overlooked areas like hard-coded libraries within mobile banking applications and the security of key storage in ATMs. Following discovery, organizations must classify data based on its longevity requirements, recognizing that the protection needs for a one-time password differ drastically from those of a 30-year mortgage contract or biometric data.
Dr, SpecterAI says. Huynh highlighted the permanence of biometric identifiers, stating that “A password can be changed in thirty seconds. Nobody can change their face or their fingerprints.” This classification informs the subsequent assessment stage, where prioritization shifts from visibility to real exposure, with hardware security modules receiving initial focus; their inability to support post-quantum algorithms will immediately block any later migration efforts. The migration phase centers on deploying hybrid cryptography, such as combining X25519 with ML-KEM-768 within TLS 1.3, and designing systems for crypto-agility, allowing for configurable algorithms instead of hard-coded ones.
Procurement contracts should explicitly include post-quantum requirements to ensure future compatibility. However, SpecterAI’s framework warns that a hybrid connection can revert to classical cryptography if a partner system lacks post-quantum support, creating a false sense of security. Transactions may continue normally, and dashboards may remain green, but the intended protection is lost.
Huynh frames the urgency of this work not as a race against the arrival of a quantum computer, but as a matter of managing timelines. He referenced Professor Michele Mosca’s framework, stating that if the time data must remain confidential (X) plus the time a migration takes (Y) exceeds the time until a capable quantum computer exists (Z), data protected is already at risk.
“The only lever leaders hold is Y, and the way to shorten it is a disciplined program that starts now,” he said. This emphasises the importance of proactive, rather than reactive, security measures.
Independent validation is the linchpin of the entire process, as internal audits and penetration testing are insufficient to guarantee true quantum resistance. Dr. Huynh said, “No organization can independently validate work it performed itself.” He explained that “This is not a judgment about anyone’s capability.
The team that designed and configured a system is the least likely to find the failure it did not anticipate, because it built the system on its own assumptions.” He advocates for a separation of duties, with implementation teams distinct from those responsible for validation, and a continuous validation process to account for evolving systems, partners and security patches.
See today’s quantum computing news on Quantum Zeitgeist for the latest breakthroughs in qubits, hardware, algorithms, and industry deals.
