Opening Keynote: The Quantum-Safe Transition

Quantum from the CISO's chair: you can't migrate what you can't see

For most security leaders, the quantum threat won't arrive as a mathematics problem. It arrives as three practical questions: which systems use public-key cryptography, who controls the libraries and hardware behind them, and what the move will cost. This talk treats post-quantum migration from the CISO's side of the table.

It starts by reframing "harvest now, decrypt later" as a data shelf-life question: which of your data must still be confidential in ten or fifteen years, and where does it travel today? It then turns Mosca's inequality into an entry a risk committee can read, with an owner, a timeline and a residual exposure. Drawing on the BIS Project Leap trials in the TARGET2 payment system, it shows why migration is a dependency and performance problem, not a cipher swap. It closes with what a board will realistically fund this year: cryptographic inventory, vendor commitments in contracts, and crypto-agility built into every new system