Quantum-Safe Isn’t Enough: Why Post-Quantum Cryptography Must Be Part of Defence in Depth

Post-quantum cryptography (PQC) will play an important role in protecting organisations against future cybersecurity risks associated with quantum computing. However, replacing vulnerable cryptographic algorithms alone will not make an organisation secure.

PQC introduces cryptographic approaches designed to resist attacks from quantum computers. It does not determine who should access sensitive information, prevent malware, or stop authorised accounts from misusing data. Organisations still need segmentation, inspection, data loss prevention, endpoint security and secure key management.

Glenn Maiden, Chief Security Officer and Director, Threat Intelligence, Australia and New Zealand, Fortinet, said, “Quantum resilience is fundamentally a data security program. Organisations need to understand where sensitive data resides, how long it needs to remain confidential, how it moves through the organisation, and which cryptographic systems protect it. Replacing RSA or ECC with new algorithms is only one part of that challenge.”

Organisations need to protect information throughout its lifecycle, including data at rest, in use and in motion. Each state presents different security requirements. For data at rest, organisations need visibility into sensitive information stored across databases, cloud storage, archives and backups. They must also understand which cryptographic systems protect that information and how encryption keys are managed.

Encryption remains one control within this architecture. Backups and snapshots should be appropriately isolated, access should follow least-privilege principles, and encryption keys should be managed separately from the information they protect.

Glenn Maiden said, “PQC may strengthen the lock; however, organisations still need to protect the cabinet, the room it sits in, and every path that leads to it. Cryptography alone is not enough. Identity controls, segmentation, inspection, access policy, monitoring, and secure key management remain critical.”

Data in use presents a different challenge. Authorised users, applications, workloads and artificial intelligence (AI) systems need access to information during processing. PQC can protect connections and cryptographic exchanges, but it cannot determine whether access is appropriate. Identity-aware access, endpoint posture, application control and zero trust enforcement therefore remain important.

Glenn Maiden said, “The goal cannot be simply to protect the key to the room. Organisations need to continuously verify who is accessing the information, which data they are using, what they are doing with it, and where that information is going next.”

Data in motion involves information travelling between branches, data centres, cloud environments, remote users and Software-as-a-Service applications. Many encrypted connections rely on public-key cryptography to establish trust and exchange keys. A future cryptographically relevant quantum computer could weaken these mechanisms.

PQC can strengthen key establishment, while hybrid approaches combine classical and quantum-resistant methods during migration. However, quantum-resistant encryption does not prevent malware transmission, unauthorised data transfers or inappropriate access by legitimate accounts. Stronger encryption must therefore complement existing security controls rather than replace them.

Glenn Maiden said, “The objective is not just to create stronger encrypted connections. It is to secure the entire environment around them with consistent policy, visibility, segmentation, inspection, and access control. Production, development, testing, backup, and key management environments should be appropriately segmented and isolated from each other.”

Segmentation and isolation can restrict lateral movement if an attacker compromises part of an environment. Meanwhile, appropriate inspection remains important for identifying malware, unauthorised applications, and sensitive data movement.

Organisations evaluating quantum security may also encounter quantum key distribution (QKD). Although both technologies address quantum-related security challenges, PQC and QKD serve different purposes.

PQC can operate through software across existing networks, endpoints, applications and cloud environments. QKD uses properties of quantum physics in the key distribution process. It may be appropriate for selected high-assurance connections where dedicated infrastructure is justified.

Glenn Maiden said, “QKD can be valuable for specialised, high-assurance links, while PQC is more broadly applicable across existing technology environments. They serve different roles, so organisations need to consider the sensitivity of the information, the architecture involved, and the level of assurance required.”

Organisations should approach post-quantum migration as a transition rather than a single cutover. Hybrid cryptographic approaches allow PQC to operate alongside established classical mechanisms while standards and implementations continue to evolve. This also reinforces the importance of cryptographic agility, allowing security architectures to adapt as algorithms, standards, implementation guidance, and risks change.

The broader objective is to integrate quantum-resistant cryptography into existing security environments rather than create a separate architecture solely for quantum threats. These environments already span users, branches, campuses, data centres, cloud environments, applications and third parties.

Glenn Maiden said, “The goal is not simply to become quantum-safe. It is to build a data security architecture that remains resilient before, during, and after the transition to post-quantum cryptography. Stronger encryption does not replace identity, segmentation, inspection, data loss prevention, endpoint security, or secure key management.”

Quantum computing will require organisations to reconsider some cryptographic foundations supporting modern digital services. However, it does not change the fundamentals of effective cybersecurity.

Glenn Maiden said, “PQC will strengthen an important component of the architecture. Building quantum resilience means combining that cryptographic transition with the visibility, governance, access controls, segmentation, and threat protection needed to secure information throughout its lifecycle.”