QiC Solutions has warned during the 20th edition of the International Information Security Meeting (ENISE) that companies and institutions must stop addressing the post-quantum transition as a one-time technological project and convert the management of their cryptography into a permanent capacity of the organization.
In the words of José Cándido Carballido, CTO of the company, “the post-quantum transition forces organizations to convert the management of their cryptography into a permanent capability.”
During his presentation, the CTO of QiC Solutions, focused not so much on predicting when there will be a quantum computer with sufficient capacity to compromise current public key cryptography systems, but on how much time an organization will need to locate the cryptography it uses, know which systems depend on it and replace it without affecting its operations.
Precisely one day before, during the opening of the meeting, the Minister for Digital Transformation and the Public Service, Óscar López, had highlighted during his opening speech the importance of quantum cybersecurity among the new challenges of digital security.
«The problem is not when the quantum computer arrives, but how long it takes us to change. And, since we are going to have to change more than once, we need a permanent capacity to do so,” Carballido pointed out during his speech.
Algorithms, certificates, implementations and standards
The thesis defended by Carballido is based on the fact that the migration to post-quantum cryptography will not be the last change that organizations will face. Algorithms, certificates, implementations and standards will continue to evolve and may force you to react again. Cryptoagility thus goes from being a response to a specific threat to becoming the ability of an organization to know, govern and modify its cryptography in a controlled manner when necessary.
The need to prepare does not depend only on the future evolution of quantum computers. The European Union’s coordinated roadmap states that all Member States must begin their transition to post-quantum cryptography by the end of 2026 and that use cases considered high risk must be migrated as soon as possible and, at the latest, by the end of 2030.
In specially regulated sectors, current obligations also point towards increasingly active management of cryptography. In the financial field, DORA and its technical development require entities to integrate technological risk into their overall risk management system, have documented policies on encryption and cryptographic controls and manage keys throughout their life cycle, including the need to adapt or replace cryptographic technologies when necessary.
Technological evolution shortens change cycles
The technological standards themselves are also reducing the margins of reaction. As the QiC CTO highlighted during his speech, as of March 15, 2026, the maximum validity of public TLS certificates has been reduced to 200 days; A figure that will drop to 100 days in March 2027 and 47 in March 2029. This change, he noted, “forces increasing the automation of inventory, renewal and management processes that could traditionally be executed with much longer cycles.”
For QiC, these changes anticipate a broader reality: cryptography is no longer a cybersecurity mechanism that can be reviewed sporadically. Regulation, standards, new vulnerabilities and technological evolution are shortening change cycles and forcing organizations to know what cryptography they use, where it is located and what consequences modifying it would have.
QiC Solutions proposes addressing this challenge from cryptoagility: providing organizations with a permanent capacity to know what cryptography they use, govern it according to their policies and needs, and modify it when necessary without compromising the continuity of their systems. All of this within a fundamental framework in the present and future of cybersecurity: the necessary sovereignty of cryptographic platforms.
The company defends that the first step towards cryptoagility does not consist of replacing algorithms indiscriminately, but rather achieving visibility over certificates, libraries, protocols, code, systems and third parties and knowing the dependencies between them. From there, cryptographic policies can become verifiable rules that allow deviations to be identified and the impact of each change to be anticipated before being executed.
Transitioning towards cryptoagility
That is precisely the area in which QiC Solutions has specialized, a 100% Spanish quantum cybersecurity company that combines specialized experience, methodology and proprietary technology to help companies and institutions in their transition towards cryptoagility.
«No organization can change what it does not know. The first condition to be crypto-agile is to know what we have, where it is, if it complies with our policies and what may stop working when we decide to change it,” Carballido concluded.
QiC argues that the first step towards cryptoagility is to achieve visibility into certificates, libraries, protocols, code, systems and third-party dependencies.
For this purpose, QiC Solutions has developed |QS, a platform aimed at automating a good part of the cryptographic management cycle: discovering assets and certificates, evaluating exposure and vulnerabilities, translating policies into verifiable rules, analyzing dependencies, prioritizing actions and supporting remediation processes, maintaining human validation in critical decisions.
The company’s approach is based on cryptographic posture management as a way to begin to gain control over existing infrastructure without initially requiring a complete re-architecture of the systems. The goal is to reduce the complexity and investment required to begin the transformation and then determine where it makes sense to undertake larger structural modifications.
