Brian C Founder & CEO, SITG-Consulting | Thought Leader & Forensic Strategist Quantum Risk, PQC, ERM, Compliance & Governance | Independent Validation | Board Advisor | Author | Quantum Risk Management 3 August 2026 This week's structural signal was verification, not capability. Anthropic stated its AI model broke a NIST post-quantum signature candidate that had survived two full rounds of accredited human expert review; the algorithm's own developers confirmed the finding an

Cyber threats evolve rapidly. Institutions in the Gulf Cooperation Council (GCC) face increasing risks. These risks target critical infrastructure, government systems, and enterprises. Strengthening cybersecurity frameworks is essential. It ensures operational continuity and protects sensitive data. This post explores how GCC institutions enhance cyber resilience through robust institutional frameworks. Strengthening Cybersecurity in GCC Institutions GCC countries prioritize

Norway’s digital ecosystem is one of the most mature and trusted in Europe. The country is now entering an early but serious quantum-transition phase. The government has begun developing a national quantum technology strategy for publication in 2026, supported by the Research Council of Norway, Innovation Norway and the Norwegian National Security Authority (NSM). Investment is also increasing, including NOK 244 million awarded to four national quantum research centres. NSM’s

The sensational headlines surrounding Anthropic’s AI work on HAWK reveal a fundamental misunderstanding of how global cybersecurity actually operates: cryptanalysis is not a panic event; it is the continuous quality-control engine of the digital world. The framing that "AI broke post-quantum security and everything is collapsing" is pure noise. Here is the reality. 1. This Is an Ongoing Discipline Run by Dedicated Teams Cryptanalysis isn't something that happens once in a blu

Cuba operates one of the most state‑controlled cybersecurity regimes in the Western Hemisphere. Its legal architecture is built on Decreto 360/2019, Decreto‑Ley 35/2021, and Resolution 105/2021, all of which focus on ICT security, cyberspace defence, telecom control, and mandatory incident reporting - none of which contain PQC migration, crypto‑agility, or quantum‑risk provisions. Government Posture: Strong Control, No Quantum Strategy Cuba’s cybersecurity model is centralise

The UAE is a high-maturity digital state with world-class infrastructure, aggressive AI adoption, and strong cybersecurity regulation. Recognizing its exposure as a global hub, the UAE moved decisively into action. In late November 2025, the UAE Cybersecurity Council approved the National Encryption Policy and Executive Regulation No. 71 of 2024, legally mandating Post-Quantum Cryptography (PQC) migration. Government Posture: Global Pioneer in Mandatory Migration The UAE's di

Not long-lived data vulnerable to HNDL. Three things sit inside your high-side enclave right now. A real-time targeting feed. A token-signing key. A cross-domain guard. None of them will appear in your long-lived data inventory, because none of them are long-lived. Compromise any one and the consequence is immediate, severe and irreversible. Ask a PQC programme what it is protecting and you will hear about long-lived data and harvest-now-decrypt-later. Correct, and incomplete

Mexico is in the developing stage of PQC adoption. The country faces elevated quantum risk due to classical cryptography across financial services, government systems, and telecom networks. Movement has begun through national cybersecurity reform and early PQC capability building, but Mexico still has no formal PQC migration roadmap. Government Posture: Cybersecurity Plan 2025–2030 Mexico’s Digital Transformation and Telecommunications Agency launched the National Cybersecur

Colombia is in the early stage of PQC adoption. The country faces elevated quantum risk due to heavy reliance on classical cryptography across financial services, government platforms, and telecom networks. Movement has begun through digital signature reform and initial alignment with NIST standards, but Colombia has no national PQC roadmap yet. Government Posture: Digital Signature Reform Colombia’s digital signature law, Law 527 of 1999, is being updated to include post qua

Every week I see organisations announcing their Post-Quantum Cryptography strategy. Strategies. Roadmaps. Working groups. Steering committees. Pilot programmes. Then along comes some actual data. DigiCert's 2026 Quantum Readiness Outlook surveyed 1,001 IT and cybersecurity decision-makers across the United States, United Kingdom and Australia. 87% say they are planning, testing or implementing PQC. Only 7% have deployed quantum-safe or hybrid cryptography across most of their

27 July 2026 This week the confirmed signal set was dominated by state and quasi-state actors building coordination infrastructure rather than by vendors announcing capability. Israel opened a funded tender for national quantum R&D infrastructure, the UK's National Cyber Security Centre convened its first joint government-industry PQC migration workshop, and Japan's government-backed research agency launched a fiscal-year-scheduled silicon quantum manufacturing programme. In

Transformation demands precision. It requires clear governance frameworks. It needs expert guidance. SITG-Consulting delivers this expertise. The firm specializes in guiding enterprises, critical infrastructure, and government organizations through complex digital risks. Their focus lies in building resilience and enabling strategic transformation. This post explores how SITG-Consulting drives transformation governance with clarity and impact. The Role of Consulting Transform

Japan is advancing PQC through national cryptographic modernization, semiconductor-rooted hardware security, and defense-aligned communication upgrades. It does not broadcast its quantum strategy loudly. However, it is one of the most structurally mature PQC environments in the world. This maturity stems from government standards, telecom backbone strength, and secure hardware ecosystems. Government Posture: CRYPTREC and MIC Modernization Japan’s cryptographic governance is a

Taiwan is advancing PQC through semiconductor security requirements, national defense modernization, and selective government upgrades. It does not publish loud quantum strategies, but it is quietly building one of the most security driven PQC environments in Asia due to geopolitical exposure and its central role in global chip supply chains. Government Posture: Security Driven PQC Adoption The Executive Yuan and National Science and Technology Council treat quantum risk as

When organisations begin planning their post-quantum cryptography (PQC) journey, the conversation almost always starts with NIST. That is entirely understandable. NIST has led the global standardisation effort for quantum-resistant cryptographic algorithms, publishing FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), FIPS 205 (SLH-DSA) and FIPS 206 (FN-DSA). These standards provide the mathematical foundation for the next generation of public-key cryptography. For many organisations, how

It has become less tolerant of the past. This month, the IETF published RFC 9846, which replaces RFC 8446 while keeping the protocol as TLS 1.3. On the surface, it looks like a minor revision. It isn't. One change stands out: Implementations MUST NOT negotiate TLS 1.0 or TLS 1.1. Not "SHOULD NOT." Not "avoid where possible." MUST NOT. That matters because we're reaching a tipping point. For years, organisations carried obsolete cryptography because "it still works." Increasin

🇧🇷 Brazil is entering the PQC transition through regulatory updates, federal digital signature modernization, and early quantum technology pilots. The country is not yet at the maturity of Singapore or India, but it has taken a decisive step by formally adopting NIST aligned PQC algorithms inside its national PKI. This marks Brazil’s shift from exploratory research toward structured national security uplift. Government Posture: ICP Brasil PQC Adoption Brazil issued ITI Nor

India is emerging as Asia’s most assertive sovereign adopter of Post Quantum Cryptography. Under the National Quantum Mission and MeitY’s PQC Task Force, the country is driving a three phase migration plan backed by domestic testing and procurement requirements. PQC has moved from research into a core element of digital sovereignty and critical infrastructure security. Government Posture: NQM Steering and Indigenous Sovereignty DST, MeitY, C DOT, CERT In, and DSCI lead a dua

Forecasting the First Practical RSA Compromise: A Scenario-Based Monte Carlo Assessment SITG-Consulting Strategic Forecasting Laboratory Research Note & Methodology Brief 1. Introduction – Why the Question Is Different Every few weeks, a new prediction emerges regarding the arrival of cryptographically relevant quantum computing. Some analysts predict an operational machine within five years; others argue it will take twenty years or longer. Most of these forecasts share a fu

For many years we have run cryptographic module readiness reviews inside larger governance and assurance engagements. It was never a named line item. It was the work done before a vendor spent money at a testing laboratory, so the money was not wasted. We have now formalised it as a defined service: the SITG FIPS 140-3 Gap Analysis. The context is a hard deadline. FIPS 140-2 certificates sunset on 21 September 2026 and move to the Historical List. From that date, a module wit