Horizen Labs

A question worth putting to your cyber risk committee this week:

What is the earliest external date that forces us to move to quantum-resistant encryption, and is it on our plan?

Most institutions can't answer it.

Not because the work is impossible, but because no one has been told to finish by when, and most don't have a map of where their encryption actually lives.

One financial regulator actually measured how ready its banks are for the shift to quantum-resistant encryption. Nearly three-quarters were not. That is a Swiss figure.

The more uncomfortable point: no US regulator measures this at all, so for the US banking system, the honest answer to "how ready are we" is that nobody knows, because nobody has been required to say.

This week's Quantum-Resistance Intelligence Newsletter breaks down:

❓ what that means for anyone who owns cryptographic risk at a financial institution.
❓ why the readiness question is unanswerable without a cryptographic inventory, and
❓what to ask before your next audit.

Read now👉 linkedin.com/pulse/72-surve…

In Part 2 of our quantum-resistant migration series, we lay out Horizen Labs' roadmap for migrating our infrastructure to quantum-resistant (QR) cryptography.

The industry consensus says harvest-now-decrypt-later is the urgent problem and signatures can wait. Horizen Labs' own infrastructure audit found close to the opposite.

Our Quantum Security and Cryptography Lead Tommaso Gagliardoni breaks down why: encryption is a configuration change, but quantum-resistant signatures for most of what a company signs (fund custody, code commits, contracts) do not exist yet in deployable form.

The result at Horizen Labs: SSH and TLS are already hybrid quantum-resistant. Signing is not, and it is the harder problem.

Read the full article 👉 bit.ly/4jjLORF

Quantum risk is a statement about the shelf life of encrypted data.

Insurance is a business built on retaining sensitive records for very long periods, which is precisely the data profile that harvest now, decrypt later is designed to exploit.

The exposure runs both ways: the archives insurers hold, and the policyholders they underwrite. Neither is currently modeled.

FINMA has named a deadline. Of 60 Swiss financial institutions it surveyed, 8% had a migration roadmap. It now expects a board-approved roadmap by mid-2027.

New from the Horizen Labs Quantum Security Team: what the exposure actually is, and the two workstreams to run before the next renewal cycle.

👉Read it full here: bit.ly/4yU23K0

We talk a lot about protecting infrastructure and data.

This is a good reminder of what that actually means for the people behind it.

This is why the work matters.

NIST finalized three quantum-resistant standards, FIPS 203, 204, and 205, in August 2024. In March 2025, it selected a fourth algorithm, HQC, as a backup standard. The final HQC standard isn't expected until 2027.

That's your regulatory baseline. The harder question: does your vendor stack meet it?

Most vendor cryptographic implementations haven't caught up. And most organizations don't know which vendors are exposed, because nobody's mapped it.

Every vendor relationship is a cryptographic surface. Adversaries harvesting encrypted data today don't need a quantum computer yet; they just need to wait.

Unmapped cryptographic exposure in a supply chain isn't a future problem. It's an unquantified liability today.

We map that exposure in 7-10 days. No software, no operational changes.
🔗bit.ly/QuantumSecurity