Insider Brief
- Black Kite has introduced Quantum Readiness controls within its Cyber Rating platform to assess observable signs of post-quantum cryptography readiness across an organization’s third-party vendors.
- The new controls examine indicators such as hybrid post-quantum key exchange, certificate signature readiness and assets without an identified migration path, integrating the results into the platform’s SSL/TLS Strength category.
- The feature is designed to help organizations track vendor readiness, identify potential gaps in supply-chain cryptographic security and prepare for post-quantum migration requirements.
PRESS RELEASE — Black Kite, the leader in third-party cyber risk management, today announced the release of Quantum Readiness, a new set of controls within the SSL/TLS Strength category of the Black Kite Cyber Rating that evaluates quantum agility across an organization’s third-party vendor ecosystem. Quantum Readiness surfaces which vendors are quantum-ready or adopting quantum-safe encryption methods, providing an early indication of security maturity and preparedness for the post-quantum era.
Quantum computers capable of breaking today’s encryption do not exist yet, but experts predict “Q-Day” could arrive as early as 2028. The risk is also retroactive: in “harvest now, decrypt later” attacks, bad actors are already collecting encrypted data to decrypt once quantum computers are powerful enough. Organizations need to prepare now – for many, the shift to quantum-safe encryption is underway, making quantum agility a key indicator of vendor security maturity and readiness.
“Third-party cyber risk management needs to account for where risk is going, not only where it exists today,” said Ferhat Dikbiyik, Chief Research & Intelligence Officer (CRIO), Black Kite. “We built Quantum Readiness to give customers early visibility into quantum agility across their supply chains and help them understand which vendors are preparing for one of the most significant cryptographic transitions ahead.”
Organizations transmit sensitive data to and through third parties every day, with limited visibility into whether those vendors are prepared to protect that data in the post-quantum era. Regulatory pressure further compounds the challenges organizations face. Post-quantum deadlines are now fixed. NIST’s schedule deprecates RSA, ECDSA, and ECDH after 2030 and disallows them after 2035. OMB M-26-15 puts US agencies on post-quantum key establishment by the end of 2030 and digital signatures by 2031. Executive Order 14412 started the clock on a federal acquisition rule requiring covered contractors to meet NIST post-quantum standards by December 31, 2030.
In the European Union, Member States are expected to have national plans and cryptographic inventories in place by the end of 2026, with high-risk critical infrastructure migrated by 2030, while NIS2 already puts supply chain security and cryptography inside risk-management obligations today.
Organizations will need visibility into the cryptographic posture of their own systems and the vendors they depend on. Black Kite provides an external measure of vendor post-quantum readiness across the third-party ecosystem, helping organizations to answer a critical question: which vendors in my supply chain are quantum-ready, which are moving toward readiness, and which may be falling behind? As a result, they are enabled to:
- Evaluate quantum agility across their third-party ecosystem
- Identify which vendors are quantum-ready or adopting quantum-safe encryption
- Track vendor readiness over time as post-quantum adoption grows
- Prepare for emerging regulatory requirements, including U.S. federal post-quantum migration mandates and the EU’s post-quantum cryptography roadmap
Key features include:
- New Quantum Readiness Controls: Assess observable signals of post-quantum cryptographic readiness, including hybrid post-quantum key exchange, certificate signature readiness, and assets without an identified migration path.
- Integrated into the Black Kite Cyber Rating: Incorporated into the SSL/TLS Strength category, bringing quantum preparedness into an organization’s existing view of third-party cyber risk.
- Quantum Agility Across the Ecosystem: Evaluate preparedness across the third-party ecosystem at scale to understand which vendors are quantum-ready or actively moving toward readiness.
“Quantum readiness cannot stop at the agency perimeter,” said Megan Rolander, Public Sector Director, Black Kite. “Federal agencies depend on complex networks of contractors and technology providers, and they need to understand how prepared those organizations are for the transition to post-quantum cryptography. Black Kite gives agencies visibility into quantum agility across that broader ecosystem before these requirements become more urgent.”
“The uncertainty around Q-Day is exactly why organizations need to prepare now,” said Konstantinos Karagiannis, Senior Director, Quantum Computing Services, Protiviti. “Cryptographic migrations take years, and sensitive information being transmitted today could remain valuable to attackers long into the future. Measuring quantum agility provides an important signal of how mature an organization’s security program is and whether they are taking the steps necessary to prepare for the coming quantum era.”
To see how Black Kite can help you evaluate quantum readiness across your third-party ecosystem, reach out to our team.