Why Post-Quantum Is a Data Problem, Not a Network Problem‍

Qanapi CEO Trent Telford spoke with Defense One on what the post-quantum transition actually asks of federal agencies and the government supply chain. The short version is below. The full argument, including his recommendations for teams working against migration deadlines, is in Defense One.

‍

Most agencies and the DIB are treating post-quantum migration as a cryptographic upgrade project: inventory the algorithms, swap the weak ones, report progress. In a recent Defense One interview, Qanapi CEO Trent Telford argues that framing is exactly the reason work stalls. Post-quantum is not an algorithm solution alone. It is a decision about where the protection lives. If encryption is bound to networks, sessions, and storage volumes, every migration becomes a rip-and-replace of infrastructure. If the protection is bound to the data object, migration becomes a noticeable more efficient policy shift instead.

‍

That distinction is the common thread throughout the article. Below are key points worth carrying into your next architecture review.

‍

The industry has spent 30 years protecting the container.

Trent’s opening premise is blunt: the cyber industry has not changed much in three decades because the internet was never designed to be secure in the first place. Everything built since has been compensating those original gaps. Firewalls, network segmentation, endpoint agents, identity providers. Each one protects the container the data happens to be sitting in at that moment.

‍

The data itself, however, has stayed unprotected. Encryption at rest protects the disk. It decrypts the moment any authorized identity touches the file. That is not a criticism of encryption at rest, but rather a description of what it was designed to do. The problem is that a control designed to protect hardware is now being relied upon to protect the data itself.

‍

Federal policy already directs prioritizing data as an asset. Operationalizing that is the hard part.

This is not a case of policy lagging behind architecture. Executive Order 14028 and OMB Memo M-22-09 already require agencies to move to zero trust, and CISA’s Zero Trust Maturity Model already names data as one of its five pillars.

‍

Trent’s observation is that the data pillar is consistently the last one agencies touch and the hardest to operationalize. Identity has vendors. Networks have vendors. Devices have vendors. Data-level enforcement has historically required custom integration work at every application boundary, which is exactly the kind of project that gets killed in a budget cycle. Agencies report maturity on four pillars and carry the fifth as a known gap.

‍

Post-quantum removes the option of deferring the data pillar

NIST has finalized the post-quantum standards. FIPS 203, 204, and 205 were published in August 2024 and the NSA has set the timeline for national security systems through CNSA 2.0. The standards question is largely settled. What hasn’t been answered, according to Trent, is the operational question: how does an organization apply new cryptography to terabytes and petabytes of data sitting in legacy systems? That gap between standards adoption and actual implementation is where most migration plans currently live.

‍

The mechanism: bind identity, policy, and encryption at the data level

This is where Qanapi’s approach stands out in the cybersecurity market. Qanapi solutions bind three things to the data object itself: the identity permitted to decrypt, the policy governing that permission, and the encryption enforcing both.Concretely, the key is tied to a user's identity and device credentials plus situational conditions, which in a defense context can include clearance level and geolocation. A file that leaves the environment it was created in does not become readable because it arrived somewhere with weaker controls. The permission travels with the object, and it is enforced cryptographically rather than by the application currently holding the file. 

‍

Crypto agility is the second half of the mechanism. Because the cryptographic decision is made at the object level through an API rather than baked into each system, changing algorithms is a configuration change rather than a re-architecture. That is what makes a 2035 deadline survivable without touching every legacy system first.

‍

Dual Provenance: what this looks like for AI

The AI implications of this topic are unmistakable across all industries, especially the defense industrial base and adjacent regulated environments. That’s where Dual Provenance matters.

‍

Positive provenance is cryptographic proof that the data entering an AI system is trusted, correctly marked and redacted (if necessary), and has a clear sourcing chain. Negative provenance is the proof that data did not leak into a training model or the LLM’s memory downstream.

‍

Both are properties of the data, not promises from the vendor. That’s the point. A contract governing AI data handling is a remedy after the fact. Encryption bound to the object at its source is a control that holds regardless of which model, subprocessor, or agent touches that data down the line.

‍

Trent’s recommendations

With the complexity of legacy and modern data spanning across multi-vendor systems, federal agencies and the DIB need a phased approach to post-quantum uplift. This starts with a discovery scan to identify non-mission-critical datasets to be remediated first. This builds the operational processes and works incrementally towards compliance rather than opening with the hardest data sets in the entire ecosystem. Most importantly: allocate some of your budget to innovators in the space who can uplift data faster and cheaper than the traditional integrators.

‍

Read the full article here.

‍