While much of the conversation around post-quantum cryptography (PQC) focuses on preventing ‘harvest now, decrypt later’ attacks on data confidentiality, organizations must also prepare for the shift in authentication systems. As quantum computers evolve, the broad ecosystem of certificates, trust anchors, PKI services, and hardware security modules will require significant updates to accommodate new, larger cryptographic algorithms.
Why Authentication is Different
Unlike data encryption, authentication relies on a complex web of trust relationships. Certificates must be issued, distributed, validated, and managed across diverse environments. Moving to post-quantum authentication involves more than just changing an algorithm; it impacts operational processes, interoperability, and the performance of existing infrastructure. Many organizations lack a complete inventory of these dependencies, making visibility the first priority.
The Need for Proactive Preparation
Enterprise environments often contain legacy infrastructure, including embedded devices and custom applications with fixed cryptographic assumptions. Because the transition will not be a simple ‘plug-and-play’ upgrade, security leaders should view post-quantum readiness as a multi-year effort. Early testing is essential to answer critical questions regarding performance, certificate chain sizes, and potential incompatibilities with network monitoring and security hardware.
Microsoft’s PQC TLS Pilot Program
To assist in this transition, Microsoft launched the PQC TLS Pilot Program in August 2026. This initiative allows eligible certificate authorities to evaluate interoperability using the quantum-resilient ML-DSA-87 algorithm. These certificates are intended solely for controlled, non-production environments to identify gaps and compatibility issues without risking production trust.
Steps for Organizations Today
Organizations do not need to wait for industry-wide standards to take action. Security teams and architects should focus on:
- Inventorying systems: Identify every service and device that relies on certificates.
- Mapping trust: Document both public and private PKI hierarchies.
- Assessing vendors: Engage with providers to understand their PQC roadmaps.
- Identifying legacy infrastructure: Highlight systems with long lifecycles that may be difficult to update.
- Developing a testing strategy: Build non-production environments to test post-quantum certificate hierarchies.
- Creating a roadmap: Treat readiness as an ongoing, multi-year program.
By starting the testing process now, organizations can uncover hidden dependencies and operational hurdles, ensuring they are well-positioned for a quantum-resistant future.
