When making a bank transfer, most people rarely think about encryption—until something breaks. That could become a problem in the quantum era.
Powerful quantum computers could eventually break some encryption methods used today. Preparing for that future means replacing encryption that spans applications, servers, cloud systems, and connected devices.
That task is becoming more complicated as companies adopt cloud services, connected devices, and AI agents. Each new system can add more software, certificates, encryption keys, and security dependencies to an already sprawling technology estate.
Bengaluru-based quantum security startup QNu Labs treats this as an infrastructure problem. The company has launched QShield 2.0, which adds tools to discover and assess cryptography across an organisation. It also includes a module focused on security risks involving AI models and autonomous agents. The company beta-tested the platform for six months before launch.
The timing matters as India is preparing for a shift towards post-quantum cryptography (PQC), designed to withstand attacks from quantum computers.
A Department of Science and Technology (DST) task force recommended that critical infrastructure sectors begin formal PQC implementation from 2027. Gartner estimates quantum computers capable of breaking RSA-2048—an asymmetric encryption algorithm widely used to secure web browsing—could emerge between 2030 and 2035.
Yet QNu Co-founder and CEO Sunil Gupta argues that migration cannot begin with simply installing new encryption.
“Quantum transition is often seen as a technology or IT problem,” Gupta tells AIM. “We see it as a digital trust or infrastructure problem.”
The Encryption Nobody Tracks
One reason is surprisingly mundane. Companies have spent decades adding encryption without necessarily maintaining the complete inventory. A new application might introduce certificates. A server might use another encryption method. Cloud services, software and connected devices can add still more.
Because companies rarely needed to replace all of this at once, Gupta says cryptography has largely remained hidden inside technology infrastructure.
“It has never been audited since it has been brought in,” he remarks. “And it comes in different sizes, shapes, and forms.”
Quantum computing changes that equation. Some encryption methods widely used today rely on mathematical problems that conventional computers struggle to solve. A sufficiently capable quantum computer could solve some of those problems much faster.
Companies therefore need to identify which algorithms they use, where their encryption keys and certificates sit, and what those systems protect. They then need to decide what to replace first.
Legacy systems complicate the process. Some applications can move to newer encryption relatively quickly. Older infrastructure could take considerably longer.
Gupta cautions against treating this as a simple software replacement.
“A lot of people don’t understand the importance of this because they think that replacing an RSA or ECC with PQC is the requirement. That’s not the requirement because it’s not an IT project.”
QNu initially expected other cybersecurity tools to handle the discovery process. The company tested existing products with customers but found they were designed mainly for conventional vulnerability assessments.
That eventually led QNu to build its own discovery capability with QShield 2.0.
The company calls the broader system its National Cryptographic Assessment and Assurance Framework (NCAAF). It follows three steps: discover what encryption exists, assess its risks, and keep checking as systems change.
Enter AI Agents
That last step is where AI agents come in.
Traditional security assessments often provide a snapshot of an organisation at a particular moment. Teams find vulnerabilities, fix them, and conduct another assessment months later.
But enterprise technology can change much faster now.
“I may get new applications, get new cloud workloads, or some new AI agent deployed,” Gupta notes. “So my environment is changing so rapidly that I can’t do a periodic assessment.”
An AI agent may communicate with applications, call APIs, or access company systems to complete tasks. Those interactions can add another layer that security teams need to track.
The issue, therefore, is not that AI agents suddenly make quantum computers more dangerous. Rather, they can make an organisation’s technology environment more dynamic while it prepares for a long cryptographic migration.
QNu wants companies to continuously update their environments instead of relying solely on periodic audits. For that, QNu is conducting assessments for large banks.
“We have early customers and have won certain deals where we are doing customer assessments and helping the large banks,” Gupta says.
India Has a Deadline, But Not a Mandate
Technology, however, is only part of India’s transition. Gupta believes India already has government funding, domestic technology, and early deployments. He sees regulation as the missing piece.
The DST recommendation gives critical sectors a direction, but Gupta wants regulators to go further. He argues that guidelines should become mandates for sectors such as banking and telecom. Without them, organisations that do not see an immediate threat may postpone migration spending.
“Only early adopters are moving, but a lot of other people are waiting for that to happen,” he remarks.
Gupta also calls for changes to government procurement. He argues that critical security technology should not be selected primarily on the lowest price.
Those views reflect QNu’s commercial interest in greater adoption of locally developed quantum security technology. They also point to a wider challenge facing India’s post-quantum plans.
Large organisations could take years to identify old encryption, prioritise systems, and migrate them without disrupting existing services. That makes it critical for organisations to start thinking about quantum security today.
“If we fail, we fail because we didn’t start early enough,” he warns.
Your reaction
Discussion
What's your take on this story?
No comments yet — be the first to share your view.