Burning Tree CEO and Founder David Lello joined RSA at Mercedes-Benz World, Brooklands, for two days of conversation about one of the most significant challenges facing security leaders today: how do we maintain control when technology is changing faster than many of the processes designed to govern it?

David presented at both the RSA Partner Event on Monday 21 September and the RSA End User Event on Tuesday 22 September, exploring the convergence of artificial intelligence, identity, cryptography, cloud-native technology and an increasingly sophisticated threat environment.

Both events generated some excellent discussion. But perhaps one of the most interesting observations came not from something that was planned, but from something that wasn’t.

Independent thinking. A remarkably consistent message.

RSA Security and Burning Tree developed their respective content independently. There had been no attempt to coordinate the narrative or align the presentations beforehand.

Yet, across the two days, the messages were strikingly consistent.

RSA’s thinking around AI and identity complemented much of what we have been exploring at Burning Tree: that the rapid emergence of AI agents creates a fundamentally different identity and security challenge.

That convergence was encouraging.

It suggests that we are moving beyond the question of whether AI will change identity security and towards the much more important question:

How do we govern it?

From cloud to cloud-native to agentic AI

One of the themes David explored was the progression we have seen in enterprise technology.

Cloud changed where technology operated.

Cloud-native changed how quickly applications and services could be created, scaled and changed.

Agentic AI changes something more fundamental again: who – or what – can act.

An AI agent isn’t simply another application consuming information. Increasingly, agents can reason, make decisions, invoke services, access data, interact with other agents and create or use identities in pursuit of an objective.

That creates enormous opportunity.

It also creates a new control problem.

The number of identities increases. Their lifecycle becomes more dynamic. Their behaviour becomes less deterministic. And the speed at which they can act becomes radically faster.

More capability. More agency. More to control.

Traditional governance processes built around human timescales – requests, tickets, approvals, periodic reviews and manual intervention – were never designed for this environment.

Security has to operate at the speed of change

This was perhaps the most important takeaway from the two days.

Control needs to operate at the speed at which change is taking place.

With AI, that speed can be extraordinary.

If an AI agent can discover a resource, obtain access, analyse information, make a decision and initiate an action in seconds, a governance process that takes hours, days or weeks cannot provide meaningful runtime control.

This isn’t only about preventing malicious activity.

Organisations also need confidence that AI systems and agents are operating within the boundaries intended for them: accessing the right information, acting with appropriate authority, producing output with the expected provenance and quality, and remaining accountable to a human or organisational owner.

That requires us to rethink the relationship between security and innovation.

Security cannot simply sit at the end of a process and decide whether something is acceptable.

Control increasingly needs to be built into the process itself.

Identity becomes the control plane

At Burning Tree, we describe this convergence as the Identity Tension Zone – the point where technology innovation, business opportunity and emerging threats collide.

Identity sits at the centre because ultimately we need to answer some deceptively simple questions:

• Who or what is acting?
• Who owns it?
• What is it allowed to access?
• What authority has it been given?
• What is it doing?
• Can we trust the information and services it is using?
• Can we prove what happened?
• And can we stop or revoke it when necessary?

Those questions apply whether the identity represents an employee, customer, workload, machine, API, AI model or autonomous agent.

As organisations move from relatively static human identities towards highly dynamic machine and agentic identities, IAM therefore becomes much more than an administrative capability.

Identity becomes a control plane for the digital enterprise.

Discovery, ownership, authentication, authorisation, least privilege, runtime access decisions, monitoring and lifecycle management all need to become part of that control plane.

Identity and cryptography: establishing trust

Identity alone, however, isn’t enough.

As systems become increasingly distributed, automated and autonomous, we also need confidence in the trust relationships beneath them.

Can we trust the identity?

Can we trust the communication?

Can we trust the data?

Can we trust the service or machine with which the agent is interacting?

Can we establish provenance?

This is where identity and cryptography increasingly intersect as foundational controls.

Identity establishes who or what is acting and what it is authorised to do.

Cryptography helps establish whether the identities, communications, transactions and information involved can be trusted.

Around those foundations sit additional layers of policy, governance, data security, monitoring, AI assurance and operational resilience.

The objective isn’t to constrain AI innovation. It is to create an architecture within which organisations can innovate safely and at speed.

The security model has to evolve

There is an important shift taking place here.

For many years, security programmes have focused heavily on establishing controls and then periodically checking whether those controls remain effective.

The AI era demands something more dynamic.

When technology can act at machine speed, security increasingly needs to discover, decide, authorise, monitor and respond at machine speed too.

That has implications for technology, architecture and governance – but also for the way security teams themselves operate.

The organisations that address this well won’t necessarily be those that impose the greatest number of controls.

They will be those that can apply the right control, to the right identity, at the right moment – without unnecessarily slowing the business down.

That is the challenge of securing the tension zone.

And there was time for a little fun…

Fortunately, not every conversation involved AI agents, identity governance and cryptography.

Mercedes-Benz World provided a rather more physical demonstration of managing risk, speed and control, with the opportunity to get out onto the track and tackle the 4×4 course.

There may even be an analogy in there somewhere: speed is exhilarating – provided you have the controls to manage it.

A huge thank you to RSA Security for two excellent events and for the continued support they give Burning Tree.

In particular, our thanks to Robert Cook, Ben Tuckwell, Alaa Abdulnabi, Jim Taylor and to everyone else involved behind the scenes. Events like these require an enormous amount of work, and that effort showed throughout both days.

Most importantly, thank you to the partners, customers and security leaders who joined the conversations and challenged the thinking.

AI is moving extraordinarily quickly. None of us has every answer.

But one conclusion from these two days seems increasingly difficult to ignore:

As technology moves towards machine-speed decision-making, security must develop machine-speed control.

And identity – supported by cryptographic trust – will be fundamental to making that possible.

#IdentitySecurity #ArtificialIntelligence #AgenticAI #IAM #CyberSecurity #Cryptography #DigitalIdentity #AIsecurity #CyberResilience #RSA Security #BurningTree

Click here to view the September 2026 Newsletter sent by email to our customers, partners and fans.

To sign up (if you have not already done so) scroll to the end of this page and opt-in.

Identity has become critical infrastructure.

Organisations increasingly depend on centralised identity services to authenticate users, control privileged access and enable access to critical systems. That has delivered significant security benefits — but it has also created a fundamental dependency.

What happens when identity itself becomes unavailable?

In the latest episode of RSA Identity Unmasked, Burning Tree CEO David Lello joins host Ingo Schubert and RSA experts Paul Mulvihill and Jon Nicholas to explore why identity resilience is becoming an increasingly important part of cyber resilience.

The discussion considers why identity systems are now attractive targets for attackers, the concentration risk created by centralised access control, and an important distinction:

Security and resilience are not the same thing.

Strong authentication, privileged access management and identity governance help prevent compromise. Resilience asks a different question: if those systems are disrupted or compromised, can the organisation continue to operate and recover?

The episode explores practical questions organisations should be asking now — including fallback access, recovery capabilities, critical dependencies and how identity resilience should be tested before an incident occurs.

For Burning Tree, this reflects a broader shift in cybersecurity. Identity is no longer simply another security control. It is increasingly the control plane for the digital organisation — and needs to be protected, governed and designed for resilience accordingly.

Watch RSA Identity Unmasked — Episode 7: Resilience 

Explore Burning Tree’s approach to Identity & Access Management →

Burning Tree CEO David Lello recently joined RSA’s Identity Unmasked video series for a special two-part discussion exploring one of the most significant challenges facing security leaders today: the intersection of Artificial Intelligence and Identity Security.
AI is changing the security landscape rapidly. But while the technology may be new, many of the underlying challenges are not.

At Burning Tree, our view is that AI does not suddenly make established security principles obsolete. Instead, it dramatically changes the speed, scale and accessibility with which vulnerabilities can be discovered and exploited. Organisations with strong identity controls, defence in depth, effective vulnerability management and mature security governance are therefore starting from a very different position from those without them.

The two RSA discussions explore both sides of this challenge.

Part 1 — How AI is Changing the Rules of Attack

The first episode examines how attackers are already using AI to scale identity-based attacks, automate social engineering and make impersonation increasingly convincing.

AI-powered phishing, deepfakes and increasingly sophisticated social engineering challenge some of the assumptions organisations have traditionally made about identity and trust.

The issue is not simply that AI creates new attacks. It can make existing techniques faster, cheaper, more scalable and more convincing.

That places greater importance on strong identity architecture, layered security controls and the ability to detect, respond to and recover when preventative controls inevitably fail.

Part 2 — Who Governs AI? Trust, Control and Accountability

The second discussion moves from attack to governance.

As organisations embed AI into business processes, applications and decision-making, important questions emerge:

Who — or what — is accessing our AI systems? What information can they access? What actions can they take? And who remains accountable for the outcome?

These are fundamentally questions of identity, access, governance and trust.

AI systems should not sit outside established security and governance disciplines. Organisations need to understand the identities interacting with AI — human and machine — control access to models and data, establish appropriate accountability, and ensure AI-driven actions remain visible and governable.

This is why we believe identity will become increasingly important as a control plane for secure AI adoption.

The organisations best positioned to take advantage of AI will not necessarily be those that adopt it fastest. They will be those that can innovate while maintaining control, resilience and trust.

Our thanks to RSA for inviting David to contribute to the conversation and for bringing together an important discussion about what AI means for the future of identity security.

Watch both episodes of RSA Identity Unmasked:
https://www.rsa.com/identity-unmasked/

Burning Tree has long been recognised for its expertise in cybersecurity, identity, and resilience. Today, we are proud to share how that same expertise is increasingly being directed beyond commercial engagements. We are supporting communities, strengthening organisations with limited resources, and contributing to causes that align with our values.

Over the past year, we have been developing a more intentional philanthropic focus. This is not about isolated acts of charity, but about applying our knowledge, experience, and network in a way that delivers meaningful, practical impact.

A key part of this journey has included our work with TST – The Teaching Staff Trust. TST are a charity that provides vital support to educators facing financial hardship. The Trust plays an important role in supporting those who dedicate their careers to education. Offering grants and assistance that make a tangible difference to people’s lives.

In working with TST, we provided our expertise at a significantly reduced cost. Not as a free service, but as a conscious decision to make our support accessible while still delivering the same level of quality and commitment.

Alongside this, we have been supporting church communities — helping them navigate increasingly complex digital and operational challenges. These organisations are often built on trust, stewardship, and service. However, they typically do not have access to specialist cybersecurity or identity expertise. Our role has been to provide guidance in a way that is both practical and appropriate to their context.

This is where the principle of proportionate security becomes important. Not every organisation needs — or can sustain — enterprise-scale controls. Instead, the goal is to implement the right level of security. Controls that are aligned to the organisation’s size, risk profile, and mission, while still meaningfully reducing exposure. For charities and churches, this means focusing on what matters most — protecting people, safeguarding data, and maintaining trust — without creating unnecessary complexity or cost.

What makes this work increasingly important is the changing nature of risk. As technology becomes more embedded in every organisation — regardless of size or sector — exposure to cyber threats is no longer limited to large enterprises. Charities, trusts, and churches are now part of the same threat landscape, but often without the same level of protection.

At Burning Tree, we believe resilience should be accessible, not exclusive. Applying proportionate, well-judged controls allows organisations to operate securely and confidently, without over-engineering solutions that don’t fit their needs.

This philanthropic direction is still evolving, but it is becoming an integral part of who we are. It reflects a simple principle: that the knowledge and experience we have built over decades can — and should — be used to serve a broader purpose.

As we continue to grow, we remain committed to supporting organisations that make a difference. Strengthening not only their resilience, but the communities they serve.

Why Identity and Resilience Matter More Than Ever

Recent headlines around Anthropic’s latest AI model have sparked predictable reactions — concern, alarm, and in some quarters, outright fear.

The narrative is compelling: AI systems capable of discovering vulnerabilities at unprecedented scale, identifying weaknesses across operating systems, applications, and infrastructure — in some cases exposing issues that have existed, unnoticed, for decades.

This is being framed as a breakthrough. In reality, it is something else entirely.

It is an inevitability.

The Real Issue Isn’t AI — It’s Exposure

The vulnerabilities being discovered are not new. They already exist — embedded in complex systems, legacy code, and interconnected platforms that underpin modern organisations.

What AI changes is not the existence of risk, but the speed, scale, and accessibility of discovering and exploiting it.

Anthropic appear to be handling this responsibly — working with governments and industry, controlling access, and coordinating remediation.

But we should be clear:

the next organisation — or actor — may not.

This Is an Asymmetry Problem

Cybersecurity has always been asymmetric. Attackers need to find one weakness; defenders must secure everything.

AI accelerates that imbalance:

• Vulnerability discovery becomes automated

• Exploit development becomes faster

• The barrier to entry lowers

This is not a future risk. It is happening now.

And it renders one assumption obsolete:

That we can find and fix everything before it is exploited.

Why Identity Becomes the Control Plane

In this environment, traditional security approaches — perimeter defence, vulnerability management, even patching — are necessary but no longer sufficient.

Because ultimately, every successful attack converges on one objective:

Access.

• Escalate privilege

• Move laterally

• Impersonate users or services

• Gain control of identities

This is why Identity and Access Management is no longer a supporting function.

It is the primary control plane for resilience.

Strong identity controls do not eliminate vulnerabilities — but they limit the blast radius when they are exploited.

From Prevention to Resilience

We need to shift the mindset:

From:

• Prevent everything

• Patch everything

• Trust that known risks are the only risks

To:

• Assume vulnerabilities exist

• Assume some will be exploited

• Design systems that contain, withstand, and recover

This is what resilience looks like in practice:

• Least privilege by default

• Strong authentication everywhere

• Segmentation enforced through identity

• Control of non-human identities (increasingly critical)

• Continuous verification, not implicit trust

Fighting Fire with Fire

There is a temptation to respond to developments like this with caution or even resistance to AI.

That would be a mistake.

If attackers can use AI to discover and exploit vulnerabilities at scale,

then defenders must use AI to:

• identify exposure faster

• prioritise risk more intelligently

• detect anomalous behaviour earlier

• automate response and containment

This is not about fearing AI.

It is about matching capability with capability.

A Moment of Clarity, Not Crisis

Anthropic’s announcement should not be seen as a breaking point for cybersecurity.

It is a moment of clarity.

It exposes what has always been true:

• systems are more fragile than we assume

• vulnerabilities are more widespread than we see

• and control is, to some extent, an illusion

The organisations that will succeed are not those that try to eliminate all risk.

They are the ones that:

• understand it

• design for it

• and build the capability to operate through it

The Bottom Line

AI has accelerated the problem — but it has also made the solution clearer.

Resilience, anchored in strong identity control, is now the foundation of effective cybersecurity.

And the organisations that embrace this — using AI as part of the solution, not fearing it — will be the ones best placed to navigate what comes next.

Join Ingo Schubert (RSA) and David Lello (Burning Tree) as they unpack quantum cryptography, timelines to real risk, and what organisations should be doing now to prepare for post-quantum identity resilience.

This extended first episode gives you the full debate — no soundbites, just real insight.
Settle in, grab the popcorn… it’s a good watch.

Click on the button below and scroll down to Episode 1

In every organisation, there is one environment so fundamental that its compromise can bring the entire business to a standstill. It isn’t finance, CRM, or even the customer-facing platforms we spend so much time securing. It’s Identity & Access Management (IAM)—and more specifically, the directory services that govern who can access what.

Recent ransomware attacks have made this brutally clear:

-> Threat actors no longer need to disrupt a system; they only need to compromise your identity layer.

Take down a single application and operations can usually continue. But take out Active Directory, and an entire organisation can be crippled within minutes.

Identity is the control plane of the business—its digital nervous system. When it fails, everything connected to it fails too.

Why IAM Is Now a Board-Level Resilience Issue

For years, IAM has been framed as an IT discipline or a security function. But the threat landscape, combined with increasing regulatory focus, is elevating identity to the heart of business resilience.

The forthcoming UK Resilience Bill is accelerating this shift. It places greater emphasis on preparedness, operational continuity and the ability to withstand shocks—whether cyber, physical, or operational.

But here’s the challenge:

Compliance alone won’t keep a business running. And resilience cannot come at the expense of agility, customer experience, or profitability.

The organisations that get this right adopt a balanced approach—strengthening the core without slowing down the business.

The New Reality: Identity Is Your Largest Attack Surface and Your Greatest Dependency

Attackers know this.

They don’t need to target your most sensitive system—they only need to:

• Compromise privileged accounts
• Disrupt authentication
• Corrupt domain controllers
• Disable recovery processes

Once identity goes down, everything else follows:

• Users can’t log in
• Applications can’t authenticate
• Cloud services fail
• Operational technology stops
• Critical business processes grind to a halt

In many of the major ransomware incidents we’ve analysed, identity compromise wasn’t a side effect—it was the primary objective.

Resilience Demands a New Approach to Identity Security

At Burning Tree, we’ve taken a targeted yet holistic approach to IAM resilience—particularly around Active Directory, which remains the most critical dependency in most enterprises.

Our framework prioritises:

1. Visibility & Clean-Up

You can’t secure what you can’t see. Organisations often underestimate dormant accounts, legacy permissions, and hidden vulnerabilities.

2. Governance & Hardening

Locking down change paths, reducing attack surfaces, and enforcing least privilege.

3. Continuous Monitoring

Real-time detection of unauthorised changes—because every AD breach begins with one.

4. Protecting High-Value Accounts with PAM

Privileged access is the crown jewels. We ensure it is controlled, audited, and recoverable.

5. AD Recovery Capabilities

Most organisations believe they can rebuild AD. Very few actually can. Tested, reliable recovery is essential.

6. Skills, Training & Culture

Identity resilience isn’t only a technical capability—it requires operational readiness.

7. Tabletop Exercises & Recovery Testing

Because resilience is not a policy. It’s a practice.

(These are reflected in the diagram below—our proven pathway to strengthening IAM resilience.)

Resilience Is Not a Project. It’s a Business Imperative.

Identity resilience is no longer simply about securing authentication—it’s about keeping the business running.

Boards are now asking:

• Can we maintain operations if IAM is compromised?
• How long could we function without AD or Azure AD?
• Do we have a tested identity recovery capability?
• Is our identity strategy aligned with new resilience expectations?

These are not technical questions. They are operational, financial, and strategic—because downtime is no longer measured in hours, but in revenue, reputation, and regulatory exposure.

A Resilient Future Starts with Identity

As the UK Resilience Bill approaches and the threat landscape evolves, organisations must rethink their priorities. Resilience is not about doing everything—it’s about doing the critical things well.

Identity is one of those critical things.

At Burning Tree, we help organisations secure and strengthen the systems that hold their business together. IAM resilience isn’t just a component of security—it’s the backbone of continuity, trust, and long-term performance.

If you’re reviewing your resilience posture or preparing for upcoming regulatory expectations, now is the time to evaluate how robust your identity environment truly is.

Because in today’s world, your business is only as resilient as your identity.

Introduction – Why this matters now

The dawn of practical quantum computing isn’t a distant science-fiction scenario — it’s a strategic challenge for today’s enterprises. The strength of prevalent cryptographic schemes (RSA, ECC, AES) was not designed against adversaries wielding large-scale quantum machines. As quantum capabilities accelerate, the concept of “harvest-now, decrypt-later” becomes a tangible threat.

Yet organisations face a paradox: While quantum risk is real and urgent, there is no unified, industry-wide standard for measuring organisational readiness for post-quantum security (PQS). How do you know if you are prepared? How do you benchmark your maturity? How do you prioritise what to fix first?

Our Answer: A Control-Based PQC Maturity Model

To address this gap, we developed the PQS Cybersecurity Maturity & Benchmarking Toolkit. Unlike frameworks built on existing standards alone, this toolkit is expressly designed to map existing controls (from ISO/IEC, NIST, PCI, Cloud Controls) to the emerging domain of PQS. It offers a pragmatic path to:

• Assess where you stand today across 10 core domains — including Application Security, Encryption Management, Key Management, Operational Resilience, Supply Chain and Threat & Vulnerability Management. • Benchmark your performance relative to peer organisations, sectors and recognised best-practice, even without a formal PQS standard yet in place. • Build a roadmap for migrating to quantum-resilient cryptography and hybrid models, aligned to upcoming NIST/ETSI algorithm milestones and vendor readiness timelines. • Demonstrate assurance to boards, regulators and clients that your cryptographic strategy is forward-looking, measurable and aligned with industry standards.

How It Works: Controls Mapped, Domains Covered

Because no dedicated PQS standard yet exists, our model draws from established frameworks: ISO/IEC 27001:2022, NIST SP 800-53 Rev 5, NIST CSF v2.0, PCI DSS v4.0, ISF SoGP 2022, the Cloud Controls Matrix (v4.0.13), ENX ISA v6.0, NCSC guidance and the 2017 Trust Services Criteria. We’ve mapped these controls into our 10 Domains, then tailored them for PQS readiness — from algorithm lifecycle and crypto-agility to vendor supply-chain dependencies and post-quantum testing.

Benefits & Outcomes for Your Organisation

Clarity. You’ll know precisely which controls need work, where your cryptographic maturity stands, and what quantum readiness means in practice.

Confidence. With a structured maturity model, you shift from reactive scrambling to proactive readiness — embedding PQS into your strategic risk and security architecture.

Comparability. Benchmarking your maturity allows you to see how you stack up against industry peers, use sector averages as targets, and articulate your position externally (to clients, regulators, insurers).

Compliance Alignment. Integrating PQS into your existing risk management, cryptography governance, and control frameworks ensures you’re not creating a separate silo — you’re strengthening the security fabric you already have.

Crypto-Agility. The model emphasises algorithm lifecycle, crypto-agile design, modular libraries and hybrid cryptography — all critical to surviving the transition to quantum-safe algorithms.

Strategic Resilience. Ultimately, you protect your sensitive data, cryptographic infrastructure and enterprise trust. The organisations that prepare now gain advantage; those that wait risk decaying trust and exposed assets.

What You Get

• A control-based maturity model with step-by-step maturity transitions (0 to 5) for each of 10 domains. • Assessment tools and scoring worksheets to evaluate your maturity, identify gaps and prioritise improvement projects. • Benchmarking data and peer comparisons to help set realistic targets and track improvement. • A migration roadmap template aligned to key PQS milestones (e.g., discovery by 2028, partial migration by 2031, full migration by 2035). • Supporting guidance on best-practice for cryptography, crypto-agility, vendor management and quantum-resilience.

Why Launch Now?

The shift to quantum-safe cryptography isn’t just a technical challenge — it’s a business imperative. Enterprises that postpone PQS planning risk falling behind, exposing long-lived data, regulatory obligations and supplier contracts. Starting early allows you to align your cryptography strategy with digital transformation, cloud migration and supply-chain resilience.

Next Steps

At Burning Tree, we help organisations turn complex security challenges into clear, actionable strategies. From assessing cyber maturity to implementing post-quantum resilience and identity solutions, our experts work alongside you to strengthen defences and build lasting confidence in your security posture.

Reflections from a discussion with Ingo Schubert, Field CTO, RSA Security, at Bletchley Park Trust.

Last month, I had the privilege of joining Ingo Schubert from RSA at Bletchley Park for an RSA event where we debated the implications of quantum computing for IT security.

While this post doesn’t replicate our conversation exactly, it follows the structure of our discussion. Ingo and I took different positions — he was a little more sceptical, and I was, perhaps, a bit more enthusiastic! But it was a lively exchange about one of the most transformative topics in our field.

Quantum Computing: A New Frontier

Quantum computing is moving from theory to reality. Unlike classical computers that process bits as 0s or 1s, quantum computers use qubits, which can exist in both states simultaneously. Through superposition, entanglement, and interference, they can perform certain calculations exponentially faster than even the most powerful supercomputers today.

That opens the door to extraordinary possibilities — from accelerated drug discovery to optimisation problems we’ve never been able to solve. But as always, where there is opportunity, there’s also risk — and in this case, that risk strikes at the very heart of digital trust.

Reality Check

It’s easy to get carried away with the hype. Fault-tolerant, large-scale quantum computers are still years away. The engineering challenges — maintaining qubit stability and managing error correction — are monumental.

Yet, waiting for the technology to mature before acting would be a serious mistake. The “harvest now, decrypt later” threat is already real. Adversaries are stockpiling encrypted data today, expecting to decrypt it when quantum power becomes available. The clock is ticking, even if the hardware isn’t ready yet.

What Will Be Possible

The core of the issue is Shor’s Algorithm, which allows quantum computers to factor large primes exponentially faster than classical machines. That means algorithms like RSA, ECC, and Diffie-Hellman — the backbone of today’s encryption — will be broken.

The same quantum capabilities will drive extraordinary advances in AI, data analytics, and materials science — but they’ll also reshape cyber risk. From codebreaking to vulnerability discovery, the balance between attackers and defenders is about to shift.

Impact on IT Security

The most immediate impact will be on cryptography. TLS, VPNs, PKI, blockchain, IoT — all depend on mathematical problems that quantum computers can solve in minutes, where classical computers would take millennia.

And it doesn’t stop there. Key management, digital signatures, certificates, and even firmware in embedded devices will be affected. For sectors where data must remain secure for decades — like government, finance, and healthcare — the urgency is now, not later.

NIST’s Post-Quantum Cryptography (PQC) standards are emerging, and vendors are beginning to offer hybrid crypto models that blend classical and quantum-safe algorithms. The challenge will be migration — knowing what to replace, when, and how.

Threats Today and Tomorrow

The biggest threat today isn’t a quantum computer — it’s complacency. We know that cryptographic migrations take years, and many systems in use today were built on algorithms standardised in the 1990s.

The risks ahead include:

• Encrypted data harvested today and decrypted tomorrow.
• Compromised digital identities as PKI trust collapses.
• Broken blockchains and invalid digital signatures.
• IoT and embedded systems that can’t be easily updated.

We can’t afford to treat quantum risk as “tomorrow’s problem.” By the time the capability exists, it will already be too late to start planning.

Preparation: A Call to Action

So, what should organisations do now?

1. Inventory your cryptography — know what algorithms and key lengths are in use.
2. Plan for agility — design systems that can adapt as standards evolve.
3. Engage with standards bodies and vendors — align early with NIST’s PQC guidance.
4. Educate boards and leadership — this isn’t just a tech issue, it’s strategic.
5. Start testing hybrid crypto — it’s the bridge between today’s and tomorrow’s world.

The move to PQC is not a “crypto upgrade” — it’s one of the largest IT transformations of the next decade. It’s about safeguarding trust, privacy, and resilience in the post-quantum era.

Final Thought

Ingo and I may not have agreed on everything — he was pragmatic, I was optimistic — but we both landed in the same place:

Most organisations are still not doing enough to prepare for an existential threat to their cryptographic keys.

Quantum computing isn’t just coming — it’s already changing how we must think about security. The question isn’t if it will affect you, but when — and whether you’ll be ready when it does.

I would like to hear: What are your thoughts on the Quantum Threat?

At Burning Tree, we help organisations turn complex security challenges into clear, actionable strategies. From assessing cyber maturity to implementing post-quantum resilience and identity solutions, our experts work alongside you to strengthen defences and build lasting confidence in your security posture.

With new threats and technologies reshaping the landscape, there’s never been a better time to take stock. Contact us today at 02045 423 332 or info@burningtree.co.uk to start securing your business for 2025 and beyond.

#PostQuantumCryptography #QuantumSecurity #CyberSecurity #Encryption #DigitalTrust #QuantumComputing #InformationSecurity #RiskManagement #IAM #CryptoAgility #SecurityStrategy #PQC #BletchleyPark #BurningTree