People often ask what SITG stands for. Today, the answer is Strategy. Intelligence. Technology. Governance. What many do not know is that the final letter was not always Governance. When the company was founded, the G stood for Growth. At the time, that made sense. The world was focused on expansion, transformation, technology adoption and business acceleration. Organisations were investing heavily in digital programmes, data initiatives, regulatory transformation and operati

Why the human mind is the primary vulnerability in cryptographic transformation The standard framing of post-quantum risk is a race between two technical trajectories: the development of a cryptographically relevant quantum computer, and the deployment of quantum-resistant cryptography. The organisation that completes its migration before the former arrives has won. It is presented as an engineering problem, a procurement problem, a programme delivery problem. This framing is

#Moody's may have delivered one of the most important post-quantum signals of 2026. Not because of a breakthrough in quantum computing. Not because of a new cryptographic standard. Because a global credit rating agency has started discussing Post-Quantum Cryptography (PQC) as a budgetary, governance and enterprise risk issue. For many years, this has been the position of SITG-Consulting. Our Quantum Risk White Paper, first published in 2024, revised in December 2025 and again

Harvest-now-decrypt-later attacks are no longer theoretical. Data is being collected today with the explicit intent of decryption once quantum capability matures. Organisations are still treating the Post-Quantum Cryptography (PQC) transition like a standard cipher upgrade. They are wrong. Procurement and implementation dominate the conversation. But implementation is a vanity metric. It proves deployment, not security. The real challenge is the testing burden. PQC does not s

THE QUANTUM RISK AND RESILIENCE – SPECIAL EDITION From Harvest to Consequence: Why HNDL Is a Governance Problem, Not a Cryptography Problem Why This Matters Discussion around post-quantum cryptography has centred on future resilience. That framing is incomplete. The material risk sits in the past. Encrypted data has already been intercepted, copied, and stored. Financial messaging, healthcare records, diplomatic traffic, corporate communications. Once copied, it is no longer

Last week I challenged a post that framed PQC discovery as a choice between infrastructure and code. The responses confirmed what I already suspected. The industry is still anchoring discovery to observation methods rather than exposure analysis. That is backwards, and it is why most discovery programmes either stall or produce inventory without insight. Cryptographic discovery is a risk discipline. It is not an asset count. The question is not where your cryptography is. It

Bridge, Mitigation, Quantum‑Washing, and Where It Fits in Transformation Hybrid cryptography is often presented as the bridge between classical cryptography and post‑quantum security. That description is broadly correct-but it is also incomplete. Hybrid is not: a replacement for classical cryptography, a finished post‑quantum architecture, or a permanent end‑state. It is a transitional mitigation model designed to reduce cryptographic exposure during a period where: quantum‑r

Forty Years of Warnings the Digital World Never Fully Operationalised For more than forty years, cryptographers, standards bodies, protocol designers, and national cybersecurity agencies repeatedly warned that digital infrastructure needed to evolve. Cryptography was never supposed to be static. Algorithms were expected to age. Protocols were expected to change. Entropy systems were expected to be monitored. Certificate ecosystems were expected to become agile. Hardware secur

Crypto Agility Is Not About Algorithms It is about whether digital trust can survive continuous change. Globally. Under pressure. Without a return to the conditions that caused this exposure in the first place. For more than two decades, cryptography was treated as a technical control. A component. A configuration. A compliance line item. That framing has now expired. The defining question of the next twenty years is not whether algorithms are strong. It is whether the global

The Operational Fault Line of the Quantum Transition Post quantum cryptography is often discussed as if the challenge is primarily mathematical. Organisations focus on algorithms, key sizes, cryptanalytic resistance and future quantum capability. Vendors announce support for ML-KEM, ML-DSA and hybrid TLS as though algorithm availability alone represents readiness. It does not. The real challenge begins after the standards are published. The operational challenge is whether th

Brian Couzens, CEO, SITG-Consulting Peter Shor published his quantum factoring algorithm in 1994. Thirty-two years later, the global cryptographic community is still responding to the consequences. That response has been substantial. NIST finalised its first three post-quantum cryptography (PQC) standards in August 2024: FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA). In March 2025, NIST selected HQC as a fifth standard, a lattice-independent backup to ML-KEM (N

Beyond Encryption: How Quantum Capability Is Creating New Forms of Systemic Risk Somewhere along the way, quantum risk became shorthand for broken encryption. Mention quantum in a boardroom, regulatory meeting or security programme and the conversation quickly turns to cryptography, harvest now decrypt later attacks and migration plans. Those concerns are real. They are also only part of the story. A much larger shift is underway. Quantum technologies are beginning to move fr

Thirteen Trust Failures That Changed Cybersecurity Forever Cybersecurity has spent decades strengthening cryptographic mathematics. At the same time, the discipline of understanding, measuring, governing, and assuring trust systems has received far less attention than its importance warrants. The result is visible throughout the history of cybersecurity. Many of the industry's largest and most expensive failures were not failures of cryptography. They were failures of impleme

I am increasingly seeing across LinkedIn, GitHub, arXiv, Zenodo and so many other repositories a flurry of poorly written nonsense on these subjects. Let’s be entirely clear, the empirical and governance realities do not match the hype. These are the global facts: 𝐓𝐡𝐞 𝐏𝐐𝐂 𝐒𝐢𝐥𝐯𝐞𝐫 𝐁𝐮𝐥𝐥𝐞𝐭 Myth: "PQC is the definitive solution." Truth: Post-Quantum Cryptography (PQC) is one component within a full cryptographic transformation. Global authorities, including CISA,

Crypto-Agility Is Not a Product The post-quantum conversation has a vocabulary problem, and the vocabulary problem is producing a strategy problem. For two years the industry has rallied around "crypto-agility" as the answer to the quantum threat. Vendors sell it. Boards ask for it. Migration roadmaps are built around it. The implicit promise is seductive: build the capability to swap algorithms quickly, and you are protected against whatever cryptanalysis (quantum or classic

Founder & CEO, SITG-Consulting | Forensic Strategist | Cyber Resilience, Quantum Risk & Governance | Transformation, ERM & Independent Validation | Writer | White Paper Author | Evidence-Based Decision Making June 15, 2026 Will this be a week to remember or not ? This week marked a critical inflection in quantum governance, cryptographic standardisation and sovereign quantum infrastructure. Capital deployed across infrastructure (Australia, Canada), cryptographic migration at

The #BIS has published a paper that challenges a common assumption in stablecoin analysis. A stablecoin transfer is often treated as a payment. The BIS examined 141 million #Ethereum transactions and 241 million #stablecoin transfer events and found that nearly 60% of transfer events occur within more complex transaction structures. These structures combine activities such as trading, lending, collateral management, liquidity provision and settlement into a single atomic tran

Long before: • PKI • Certificates • Digital Signatures • Identity Providers • Zero Trust • Encryption People still had the same problem. How do I know this is genuine? How do I know it hasn't been altered? How do I know who sent it? How do I know who touched it? How do I know I can trust it? The solutions may look familiar: Certificate Authority → King's Seal Digital Signature → Wax Seal Authentication → Signet Ring Ident

Does the Postman always Deliver? Well SITG-Consulting do. Always. Over the past few days, we have built something that started as a simple idea and evolved into a genuinely useful resource. The result is a searchable reference library containing 1,540 terms covering: • Governance • Risk • Resilience • Transformation • Cyber Security • Cloud Security • Identity & Access Management • Cryptography • Post-Quantum Cryptography • Quantum Computing • AI Security • Standards & Regula

Ain't No Mountain High Enough. Ain't No Valley Low Enough. Ain't No River Wide Enough. Yet somehow, translating technical language into something a board can understand often feels impossible. Quantum Risk. Quantum Readiness. Quantum Security. Post-Quantum Cryptography. Cryptographic Agility. Harvest Now Decrypt Later. The definitions exist. The challenge is that they are often written for specialists rather than decision-makers. So we built something different. The SITG-Cons