QiC Solutions used its participation in the 20th International Information Security Meeting (ENISE) to warn that companies and public agencies need a long-term approach to the shift toward post-quantum cryptography. The company stressed that this process shouldn’t be limited to a one-off technical fix, but should be built continuously into organizations’ security strategy.
In his talk, José Cándido Carballido, Chief Technology Officer (CTO) of QiC Solutions, stressed that adapting to the post-quantum landscape requires setting up permanent mechanisms to manage cryptographic systems. The main concern, he explained, shouldn’t be pinpointing when quantum computers capable of breaking today’s public-key encryption methods will appear, but assessing how ready organizations are to respond. The pressure is already showing up elsewhere in the software stack: Oracle’s latest Java release also added post-quantum cryptography support for exactly this reason.
Carballido went on to stress how important it is to know how long companies and institutions would need to identify the cryptographic technologies they use, analyze the systems that depend on them, and replace them without disrupting the normal running of their services.
These remarks came after Spain’s Minister for Digital Transformation and the Civil Service, Óscar López, pointed to quantum cybersecurity as one of the major emerging challenges in digital protection during the event’s opening session.
“The problem isn’t when the quantum computer arrives, but how long it takes us to change. And since we’re going to have to change more than once, we need a permanent capability to do it,” Carballido said during his talk.
Carballido’s argument starts from the premise that migrating to post-quantum cryptography won’t be the last change organizations face. Algorithms, certificates, implementations, and standards will keep evolving and may force them to react again. Crypto-agility thus moves from being a response to one specific threat to becoming an organization’s ability to know, govern, and modify its cryptography in a controlled way whenever needed.
The Clocks Are Already Running
The need to prepare doesn’t depend solely on how quantum computers evolve in the future. The European Union’s coordinated roadmap requires all member states to begin their transition to post-quantum cryptography before the end of 2026, and high-risk use cases must be migrated as soon as possible and no later than the end of 2030.
In heavily regulated sectors, current obligations are also pushing toward increasingly active cryptography management. In finance, DORA and its technical standards require firms to fold technology risk into their overall risk management system, keep documented policies on encryption and cryptographic controls, and manage keys throughout their lifecycle, including adapting or replacing cryptographic technologies whenever necessary.
Technology standards themselves are also shrinking the room to react. As QiC’s CTO pointed out during his talk, the maximum validity of public TLS certificates has been cut to 200 days since March 15, 2026, a figure that will drop to 100 days in March 2027 and to 47 in March 2029. This shift, he noted, “forces organizations to ramp up automation of inventory, renewal, and management processes that could traditionally run on much longer cycles.”
For QiC, these changes point to a broader reality: cryptography is no longer a cybersecurity mechanism that can be reviewed every so often. Regulation, standards, new vulnerabilities, and technological change are shortening the cycles of change and forcing organizations to know what cryptography they use, where it sits, and what the consequences of changing it would be.
Sovereignty Over Cryptographic Platforms
QiC Solutions frames the challenge around crypto-agility: giving organizations a permanent capability to know what cryptography they use, govern it according to their policies and needs, and change it when necessary without disrupting the continuity of their systems. All of this sits within a framework that’s central to cybersecurity now and in the future: the need for sovereignty over cryptographic platforms.
The company argues that the first step toward crypto-agility isn’t replacing algorithms indiscriminately, but gaining visibility over certificates, libraries, protocols, code, systems, and third parties, and understanding the dependencies between them. From there, cryptographic policies can become verifiable rules that make it possible to spot deviations and anticipate the impact of each change before carrying it out.
That’s precisely the field QiC Solutions has built its business around: a 100% Spanish quantum cybersecurity company that combines specialized expertise, methodology, and its own technology to help companies and institutions through their transition to crypto-agility.
“No organization can change what it doesn’t know. The first condition for being crypto-agile is knowing what you have, where it is, whether it complies with your policies, and what might stop working once you decide to change it,” Carballido concluded.
To that end, QiC has developed |QS>, a platform designed to automate much of the cryptographic management lifecycle: discovering assets and certificates, assessing exposure and vulnerabilities, translating policies into verifiable rules, analyzing dependencies, prioritizing actions, and supporting remediation processes, while keeping human validation in critical decisions.
The company’s approach relies on managing cryptographic posture as a way to start gaining control over existing infrastructure without initially requiring a full system re-architecture. The goal is to reduce the complexity and investment needed to start the transformation and later determine where it makes sense to carry out larger structural changes.
Frequently Asked Questions
What is crypto-agility?
It’s an organization’s permanent capability to know, govern, and change its cryptography in a controlled way whenever needed, rather than a one-off reaction to a single threat.
When must companies start migrating to post-quantum cryptography?
The EU’s coordinated roadmap requires all member states to begin the transition before the end of 2026, with high-risk use cases migrated by the end of 2030 at the latest.
How short will TLS certificate validity become?
Its maximum validity was cut to 200 days on March 15, 2026, and will drop to 100 days in March 2027 and 47 days in March 2029.
What does QiC Solutions’ |QS> platform do?
It automates much of the cryptographic management lifecycle: discovering assets and certificates, assessing exposure, translating policies into verifiable rules, analyzing dependencies, and supporting remediation, while keeping human validation for critical decisions.
