Quantum Risk Research
Overview
Rapid advancements in quantum science and technology are creating significant opportunities for innovation while introducing complex cybersecurity challenges for government, critical infrastructure, and the broader commercial marketplace. Of particular concern is the potential for cryptanalytically relevant quantum computers (CRQCs) to compromise widely deployed public-key cryptographic systems, threatening the long-term confidentiality, integrity, and trustworthiness of sensitive information and critical systems.
The University of Illinois Urbana-Champaign's Information Trust Institute (ITI) is conducting research focused on how organizations prepare for and respond to these evolving risks. Initially focused on threat awareness, organizational preparedness, and cross-sector knowledge sharing, the research has evolved to address the practical challenges of transitioning to post-quantum cryptography (PQC), achieving sustainable crypto-agility, and preparing for continued advancements in quantum technologies.
Central to this effort is an ongoing cross-sector research and discussion forum that brings together critical infrastructure operators, government representatives, technology providers, researchers, and other stakeholders. This initiative examines migration strategies, implementation obstacles, vendor capabilities, regulatory developments, and organizational dependencies that influence the pace and effectiveness of quantum risk mitigation.
Ongoing research seeks to understand and translate shared experiences and emerging technical developments into actionable insights that support more effective organizational decision-making, measurable progress toward cryptographic resilience, and readiness for an accelerating quantum technology environment.
Advancing Crypto-Agility and Post-Quantum Migration
As post-quantum cryptographic standards mature and adoption expectations increase, organizations face challenges that start with learning, planning, and discovery then transition from assessment to implementation and measurable results.
Crypto-agility—the ability to modify, replace, and manage cryptographic mechanisms as requirements and threats evolve—is an important component of this transition. However, achieving enterprise-wide crypto-agility requires more than replacing cryptographic algorithms. Organizations must identify cryptographic dependencies, prioritize vulnerable systems, coordinate with technology providers, evaluate interoperability, and manage operational and financial constraints across increasingly complex environments.
The transition is further complicated by legacy infrastructure, long-lived devices, software and hardware dependencies, evolving standards, and differences in vendor readiness. Organizations must balance near-term risks, including harvest-now-decrypt-later threats, against uncertain timelines for the arrival of cryptanalytically relevant quantum capabilities. Identification of common obstacles is central to ongoing discussions.
ITI's research increasingly focuses on the practical intersection of migration execution, emerging commercial solutions, measurable crypto-agility, and organizational readiness. Areas of investigation include identifying barriers to implementation, evaluating the capabilities and limitations of vendor solutions, and considering how automation and artificial intelligence may assist with discovery, migration planning, validation, and ongoing cryptographic management.
An important research objective is to interpret how rapid progress toward adopting quantum-resistant cryptography is balanced with achievement of sustainable organizational crypto-agility. These related but distinct goals require credible methods of evaluation, meaningful performance measures, and continued adaptation as both technologies and threats evolve.
Project Update: From Awareness to Implementation
Since launching a recurring cross-sector discussion forum in April 2025, ITI's Quantum Risk Research initiative has evolved from an emphasis on understanding emerging risks to examining the strategies, technologies, and organizational decisions necessary to address them.
The forum brings together participants from critical infrastructure, government, academia, finance, manufacturing, and healthcare among others to exchange experiences, examine developments, and identify persistent challenges. We created a collaborative setting for exploring both established approaches and emerging solutions without favoring a particular commercial technology or provider. The current group includes 170+ individuals from over 100 different end user organizations who have participated in one or more group discussions.
Active discussions focus on the effectiveness of PQC migration strategies, validation of commercial solutions, measurement of crypto-agility, enterprise-scale implementation challenges, and the potential role of artificial intelligence and automation in accelerating migration. We continue to discuss how regulatory developments, quantum computing advances, and changing expectations about the timing of quantum threats may influence organizational priorities and investment decisions.
Our goal is to support the ongoing transition from planning to implementation while helping participating organizations anticipate and prepare for continued acceleration in quantum technologies.
Check the Informational Resources section below for topical content supporting navigation of the vast amount of information being generated by the marketplace-associated challenges. Hopefully, these are helpful to you as you seek to understand, formulate, and implement quantum risk mitigation strategies. These are a few resources to assist you.
Informational Resources
Standards and Strategy
- PQC Migration Roadmap | Post-Quantum Cryptography Coalition (MITRE Partnership Network & Post Quantum Cryptography Coalition (PQCC))
- NIST Website – Post Quantum Cryptography (Search for NIST Content and Updated Information)
- Cryptographic Resilience Community Profile (Governance Approach Introduced during April 23, 2025 call)
- NIST Cyber Security 39 - Cryptographic Agility (March 2025 - NIST Cybersecurity 39 – Reference Shared during April 23, 2025 call)
Educational Material
- Podcast Resource for Education and Quantum Marketplace Activity (Post Quantum World Podcasts)
- A Transport Layer Security TLS Primer (from Medium)
- Crypto Agility Maturity Model Version 1.1 9/23/2022 (CAMM – A Crypto Agility Maturity Model)
- PQC Risk Assessment: Measuring Adoption, Anita Nikolich and Phuong Cao, NCSA
- Quantum Cryptography (@ Illinois), Maxwell Gold and Selina Nie
Vendor Perspectives and Approaches
- AWS re:Inforce 2025 Presentation (YouTube) – Patel and Rambhia (Areas of Responsibility Example - 18:24 min video)
- Automated Cryptography Inventory Explained – Cryptosense (High-level what is the process - 5:12 min video)
- Cryptographic Discovery in Action – Keyfactor (Examples and demo - 29:18 min. video)
Request to Participate
Please send an email to the Project PI, Dominic Saebeler at dsaeb2@illinois.edu for additional information about this project and potential participation.