Estimated reading time: 8 minutes
About one in five companies Black Kite monitors shows post-quantum encryption on at least one public system. Black Kite’s research chief says much of that likely came from their cloud providers. Its security chief says insurers have already asked about it.
Black Kite has a number for how many companies look ready for quantum-era encryption. Its own research chief is quick to warn against reading too much into it.
Black Kite rates companies’ cyber risk from the outside. Customers use the ratings to check their vendors. On Oct. 21, it added Quantum Readiness to that rating. The new controls look for public signs that a company is preparing for quantum computers. Those machines could one day break the encryption that protects most internet traffic. Black Kite sells its ratings to companies, insurers and brokers.
About 21% of the companies it monitors have at least one internet-facing system that supports hybrid post-quantum key exchange. That is more than 68,600 of about 330,000 companies. Dr. Ferhat Dikbiyik, Black Kite’s chief research and intelligence officer, gave CINI the figures.
Many Companies Inherited Their Quantum Readiness
“The figure needs context,” Dikbiyik said. Some of the largest cloud and content delivery providers switch hybrid key exchange on by default. Cloudflare has done so for sites it serves since 2022.
Many of the 21% likely inherited the protection from a provider, he said. That still protects traffic between users and the provider. “But it doesn’t prove a deliberate migration,” he said. The provider’s link back to the company’s own servers may still use older encryption.
Black Kite hasn’t measured how much of the 21% comes from providers. It hasn’t broken the figure down by sector or company size either. There is no trend line yet. Black Kite started measuring with this release.
What An Outside Scan Can’t See
An external scan sees what anyone on the internet can see, Dikbiyik said. That includes attackers. It can’t see traffic between internal systems or encrypted data at rest. Internal certificates and private links to partners stay hidden too. He can’t put a number on how much that leaves out.
Readers should treat the rating as “an outside-in signal,” he said. It covers traffic crossing the public internet. That is the traffic an adversary can most easily record today. Attackers can copy encrypted data now and unlock it once a capable quantum computer exists. Security teams call that harvest now, decrypt later.
The rating complements what a vendor can show about its own systems, Dikbiyik said. A cryptographic inventory is one example. IBM’s John Buselli put that inventory first among the questions underwriters should ask at the recent Zywave Cyber Risk Conference in New York City.
One In 630 Has No Easy Upgrade
Some servers can’t simply be upgraded, Dikbiyik said. A server with modern key exchange can usually add post-quantum protection through a software update. Others still use an older method called RSA key transport. They have no forward secrecy and no TLS 1.3. They must be reconfigured before any post-quantum upgrade is possible.
Those servers are weaker today. “If their private key is ever stolen, previously recorded traffic can be decrypted, quantum computer or not,” he said. More than 500 of the companies Black Kite monitors have at least one. That is about 1 in 630.
Insurers Price The Next 12 Months
Carriers and brokers use Black Kite’s ratings in underwriting, Bob Maley, Black Kite’s CSO, said. They also use its Ransomware Susceptibility Index. A score above a set threshold typically sends an application to a human underwriter rather than straight-through processing. Black Kite has published a case study describing Markel’s use of its platform to screen submissions.
The rating updates continuously rather than at renewal, Maley said. It doesn’t depend on the applicant filling out a questionnaire. “Questionnaire answers are aspirational more often than they are false; people describe the program they think they have,” he said. CINI’s Cyber Tzar podcast made a similar case for continuous monitoring.
A number of insurance customers asked about the quantum feature as soon as it was announced, Maley said. “Insurance prices the next twelve months, and a quantum-capable adversary is not a twelve-month risk,” he said. “Harvest-now, decrypt-later collection is, and that’s the question.”
Get The Cyber Insurance News Upload Delivered
Subscribe to our weekly newsletter!
That puts pressure on the policy clock. Most cyber cover is claims-made. Data stolen today and decrypted years later could fall outside the policy in force, CINI reported in June. Coalition expects PHP2Shell claims to trail the break-ins by weeks. Harvest now, decrypt later could stretch that gap to years.
Buselli raised the same problem in New York. “I may know when it’s stolen, but I may not know when it was decrypted,” he said. At least one carrier has written quantum into its wording. Cowbell added explicit quantum computing cover to Prime One in April, CINI reported.
The Data Most Exposed To Harvest Now, Decrypt Later
Black Kite hasn’t analyzed its data by vendor type. Exposure depends less on industry than on how long data must stay secret, Dikbiyik said. These attacks matter most for data still sensitive ten or more years from now. He listed health records, legal files and government information. Identity and financial data also qualify, such as the data payroll providers hold.
Cloud and other service providers stand out for a different reason, he said. “They concentrate many organizations’ data in one place.” So the question reaches nearly every company through its vendors. Buselli made the same point. Third parties provide 50% to 80% or more of a company’s infrastructure, he said.
Whose Q-Day?
Black Kite’s release said experts predict Q-Day “could arrive as early as 2028.” Q-Day is the point when a quantum computer can break today’s public-key encryption. CINI asked whose estimate that was.
It is Niccolo de Masi’s, Maley said. De Masi is IonQ’s chairman and CEO. He repeated the 2028 forecast on CNBC in September, 24/7 Wall St. reported. IonQ had just published a blueprint for breaking 256-bit elliptic-curve signatures. It estimates a machine with about 20,000 physical qubits could do it in just under 26 days. IonQ also sells quantum security products. “Readers should weigh the estimate with that in mind,” Maley said.
“It’s the aggressive end of a range,” he said. Gartner predicted in 2024 that quantum computing would make conventional cryptography unsafe by 2029. It expects that cryptography to be fully breakable by 2034, PostQuantum.com reported. Google set 2029 as the deadline for its own migration in March, the same outlet reported. Its researchers had cut the estimated qubits needed to break RSA-2048 to about one million, from 20 million.
Forecasters on Metaculus put the first quantum factoring of an RSA number around 2034, BeInCrypto reported last November. NIST’s transition plan deprecates quantum-vulnerable algorithms after 2030. It disallows them after 2035. Buselli expects the odds of a code-breaking machine to rise “very, very significantly” by 2033 to 2035.
Whichever year proves right, the exposure “is already on the books,” Maley said. “Encrypted traffic recorded in 2026 doesn’t care when the machine arrives.” What matters is whether the data inside is still sensitive on that day, he said. “For health records, legal files, and identity data, the answer is yes under every estimate on that list.”
FAQ – Quantum Readiness
What is quantum readiness?
It means signs that a company is preparing its encryption for quantum computers. Black Kite measures it from outside, using public signals such as hybrid post-quantum key exchange.
How many companies show post-quantum encryption?
About 21% of the companies Black Kite monitors have at least one public system that supports it. Black Kite says many likely inherited it from cloud providers.
What is harvest now, decrypt later?
Attackers copy encrypted data today and unlock it once a capable quantum computer exists. Data that must stay secret for a decade or more faces the most risk.
When is Q-Day?
Estimates vary. IonQ’s CEO says 2028. Gartner says conventional cryptography becomes unsafe by 2029. NIST deprecates vulnerable algorithms after 2030 and disallows them after 2035.
Do insurers look at quantum readiness?
Black Kite says carriers and brokers use its ratings to route applications to underwriters. A number of insurance customers asked about the quantum feature at launch.
Why does quantum risk matter for claims-made cyber policies?
Data stolen today might be decrypted years later. That loss could fall outside the policy in force when the theft happened.
Related Cyber Insurance Posts
- AI Didn’t Create The UK’s Cyber Weaknesses. It Revealed Them, The NCSC Says.
- IBM’s Quantum Safety Lead Doesn’t Expect A Cyber Catastrophe. If One Comes, He’s Watching Payments.(Opens in a new browser tab)
- Black Kite: Over 70% of Major Retailers Show Exposed Credentials in 2026(Opens in a new browser tab)
- Black Kite 2026: Europe’s Ransomware Surge Now Runs Through Your Suppliers(Opens in a new browser tab)
- Black Kite’s 2026 Supply Chain Vulnerability Report Delivers A Precision Framework For An Imprecise World(Opens in a new browser tab)