Mexico PQC Spotlight: Developing Readiness, Cybersecurity Reform, High Quantum Exposure

Mexico is in the developing stage of PQC adoption. The country faces elevated quantum risk due to classical cryptography across financial services, government systems, and telecom networks. Movement has begun through national cybersecurity reform and early PQC capability building, but Mexico still has no formal PQC migration roadmap.

Government Posture: Cybersecurity Plan 2025–2030

Mexico’s Digital Transformation and Telecommunications Agency launched the National Cybersecurity Plan 2025–2030, the first unified national defense framework. It centralizes 68 CSIRTs and CERTs to fix fragmented posture. Mexico is the second most attacked country in LATAM, with LockBit as the dominant threat and government and financial systems as primary targets. A severe skills gap limits response capability. This plan is Mexico’s most significant structural step toward PQC aligned modernization.

Quantum Risk Profile

A 2026 assessment places Mexico at Q Day Readiness Score 45 out of 100, classified as developing with elevated risk. Between $2B and $15B in digital assets rely on RSA 2048, ECDSA, and AES 256, creating a long vulnerability window under quantum attack models. Mexico faces a high harvest now decrypt later threat level. Financial services, government communications, telecom networks, and digital asset ecosystems are the highest risk vectors. Migration toward ML DSA and ML KEM is recommended.

Digital Government & National Strategy

Mexico does not have a formal PQC strategy, but quantum technologies are now part of the digital transformation agenda. Near term priorities focus on capability building: PQC, quantum sensing pilots, HPC QC workflow testing, quantum software, metrology, standards, procurement discipline, and workforce formation. Research capacity is small but growing through UNAM, IPN, and Tecnológico de Monterrey.

Financial Sector

Mexico’s financial sector is the most exposed domain. Interbank messaging, digital asset ecosystems, and payment infrastructure depend on classical cryptography. Regulators are being advised to adopt crypto agile planning and begin transition toward ML DSA and ML KEM. The sector faces systemic risk and will be the first pressure point for PQC deployment.

Telecom & Infrastructure

Telecom networks face elevated quantum decryption risk due to high encrypted traffic volume, lack of crypto agile infrastructure, and historically fragmented security architecture. The National Cybersecurity Plan aims to unify and harden these systems.

Bottom Line

Mexico is developing but exposed. The country has a national cybersecurity plan but no PQC roadmap, an elevated quantum risk profile, high HNDL threat level, and financial and telecom sectors under significant cryptographic stress. PQC capability building has begun, but migration planning is still early.

#Mexico #PQC #Quantum #LATAM

PQC Discovery Sprint | Sitg-Consulting