For decades, enterprise encryption has relied on established algorithms. However, quantum computers capable of breaking current encryption may emerge within this decade, accelerating the move to post-quantum cryptography (PQC). Unlike today’s battle-tested algorithms, PQC is still developing.
“It’s literally year one,” explains Richu Channakeshava, Senior Product Manager who leads quantum security initiatives at Palo Alto Networks. “If you look at RSA, it took 20 years to be generally trusted and adopted.”
As organizations implement PQC, algorithms will evolve, new vulnerabilities may surface, and standards will advance. This ongoing change requires cryptographic agility, allowing security teams to quickly modify algorithms to maintain quantum security and reduce risk.
Understanding cryptographic agility
NIST defines cryptographic agility, or crypto-agility, as “the capabilities needed to replace and adapt cryptographic algorithms for protocols, applications, software, hardware, and infrastructures without interrupting the flow of a running system to achieve resiliency.” In practice, crypto-agility transforms quantum-resistant cryptography from a static implementation into an evolving operational capability.
NIST’s recent post-quantum standards represent only the initial set of algorithms, with further evaluations ongoing as quantum threats and performance requirements change. Crypto-agility allows your systems to adopt updated standards quickly, without major redevelopment. You can swap algorithms through configuration updates rather than application rewrites.
This ability reduces risks from vulnerable algorithms, regulatory changes, and interoperability challenges, and significantly shortens response times. It also supports hybrid deployments for transitioning from conventional to post-quantum cryptography.
Crypto-agility turns quantum migration from a one-off capital project into an ongoing initiative that reduces remediation costs and disruption and gives boards definitive metrics for quantum-safe progress. Essentially, quantum readiness establishes a quantum-safe baseline, while crypto-agility ensures continued protection as algorithms, standards, and vendor ecosystems evolve.
Advantages of crypto-agility include:
- Improving business continuity and resilience by enabling secure algorithm updates without disrupting operations
- Lowering program costs through a repeatable process, even when managing large volumes of certificates, keys, and embedded or legacy systems
- Preventing vendor lock-in and ecosystem dependence by using flexible encryption platforms
These benefits are already visible in modern security platforms. Channakeshava notes that Palo Alto Networks’ PAN-OS 12.1 platform demonstrates crypto-agility in practice: security teams can switch to hybrid PQC cipher suites or newer algorithms with a simple configuration change, rather than rewriting code.
“PAN-OS provides cryptographic agility through flexible support for multiple standards and pre-standard algorithms, even for IoT environments and legacy infrastructure,” she says.
The core components
Three fundamental elements are essential for achieving and maintaining cryptographic agility:
- A governance structure to establish oversight, policies, ownership, and processes for approving or deprecating algorithms. Governance ensures consistent decisions and demonstrates due diligence to regulators and boards.
- Automation for agile management of certificate lifecycles, algorithm rollouts, and compliance monitoring. Automation turns algorithm replacement from a lengthy manual process into routine updates, reducing deployment time and maintaining consistency across infrastructure.
- Modularity to separate encryption code from business applications through abstraction layers. This enables algorithm updates through policy changes, helping future-proof systems for ongoing PQC evolution.
Maintaining crypto-agility
Crypto-agility shifts PQC from a one-time migration to ongoing adaptability. The basic steps include:
- Inventorying where cryptography lives across systems and vendors
- Assessing risks and prioritizing high‑value and long‑lived data
- Re-architecting key platforms to use crypto‑abstraction layers instead of hard‑coded algorithms
- Automating certificate, key, and algorithm updates so future changes become routine
Many crypto-agility activities overlap with quantum readiness steps, but the intent and outcomes of these initiatives differ.
Quantum readiness typically focuses on preparing for quantum threats and executing the initial migration. Crypto-agility is a design principle for quantum-safe readiness and security. It builds on readiness by embedding a modular cryptographic architecture and adding metrics for ongoing updates, so you can adapt to future changes without duplicating the same extensive effort.
Mature organizations also define basic metrics, such as time to replace a vulnerable algorithm or compliance readiness score, to track crypto-agility over time.
Start future-proofing your security
Cryptographic agility is not a new concept. But it’s especially critical today as quantum computing threatens the foundation of secure communications.
“The quantum threat is one of the top challenges that most of the C-level executives face today,” Channakeshava says. “Organizations need to build crypto-agility into their infrastructure to make quantum security a sustainable capability.”
Organizations that act now gain strategic control. They can adapt to standards on their own timeline, respond to threats faster, and lead the transition rather than react to it.
Ready to assess your crypto-agility posture? Palo Alto Networks’ Quantum Readiness Assessment provides a clear starting point.
