Europe’s PostQat Project Treats Aviation PQC as a Safety-Critical Systems Migration
The EU-funded PostQat project began September 1 to study post-quantum security for air traffic management. Its scope shows why aviation migration must…
Vista Insights
Cryptography is becoming an operating discipline.
Practical analysis for leaders building cryptographic visibility, sequencing post-quantum migration, governing risk, and producing evidence that stands up to scrutiny.
The library
Latest insights
Analysis, field notes, and product thinking
-
-
Post-Quantum Authentication Is the Longer Migration Hiding Behind Key Exchange
The IETF is asking operators for real deployment evidence on post-quantum authentication. The request exposes a migration spanning certificates, trust stores, signing…
-
CycloneDX 2.0 Points Beyond a Static CBOM Toward Governed PQC Migration
CycloneDX 2.0 is expected to connect cryptographic inventory with owners, risks, evidence, target dates, and migration status. The preview shows why a…
-
The UK DWP Key-Management Policy Makes Cryptographic Inventory an Operating Control
The UK DWP’s updated key-management policy links inventories to ownership, supplier contracts, incident response, audits, and lifecycle controls—a practical model for governing…
-
Singapore’s Quantum-Safe RFI Shows Why PQC Procurement Needs Verifiable Evidence
Singapore is testing the market for quantum-safe products and services. Buyers should use the same moment to demand precise capability boundaries, cryptographic…
-
The HAWK Result Is a Case for Cryptographic Status, Not PQC Paralysis
HAWK’s withdrawal from NIST consideration shows why cryptographic inventories must distinguish candidates, standards, implementations, and deployments.
-
The Quantum-GUARD Act Treats Grid PQC as an IT and OT Migration Problem
The proposed Quantum-GUARD Act emphasizes realistic testing, cryptographic discovery, and coordinated PQC migration across electric-grid IT and OT.
-
Hybrid PQC Key Exchange Is Progress—Not Complete Quantum Readiness
A 2026 Internet measurement study found substantial hybrid key-exchange support but no observed hybrid PQC certificates, highlighting an incomplete transition.
-
RFC 10024 Turns Hybrid PQC TLS into an Inventory and Interoperability Task
The IETF’s new hybrid TLS 1.3 RFC standardizes ML-KEM combinations and makes negotiated groups, obsolete experiments, and interoperability part of cryptographic inventory.
-
Europe’s New QKD Program Reinforces a Practical Lesson: Quantum Communications Still Need PQC Governance
A new EuroHPC research call requires QKD integration with classical networks, enterprise key management, and hybrid QKD-PQC demonstrations.
-
Federal Identity Is Becoming a Post-Quantum Inventory Problem
GSA’s quantum-resistant identity work demonstrates why agencies need a living inventory of algorithms, credentials, systems, vendors, and dependencies.
-
The UK’s 2028 PQC deadline is really a cryptographic discovery deadline
The UK NCSC expects discovery and an initial migration plan by 2028, priority migrations by 2031, and completion by 2035. Here is…
-
The EU post-quantum roadmap: risk-based migration needs shared evidence
What the EU’s coordinated PQC roadmap means for risk classification, critical infrastructure, supply chains, crypto agility, and migration evidence.
-
Canada’s PQC roadmap turns migration into an annual evidence cycle
Canada’s federal PQC roadmap requires plans, annual progress reporting, prioritized migration by 2031, and completion by 2035. Here is what the model…
-
OMB M-26-15: the federal PQC migration plan now has a concrete shape
A practical reading of OMB M-26-15: the 120-day plan, the December 2030 objective, governance, inventory, prioritization, procurement, and evidence.
-
Executive Order 14412 makes PQC migration an operating mandate, not a research project
What the June 2026 U.S. post-quantum cryptography order changes for federal agencies, critical infrastructure operators, and technology suppliers.
-
PQC standardization is not finished—and that is why crypto agility matters
NIST’s first PQC standards are ready, while HQC and nine additional signature candidates continue through the pipeline. Migration plans need progress and…
-
Federal PQC deadlines are here: what agencies and contractors should do now
The 2026 federal deadlines are explicit for agencies, while a contractor FAR rule is still forthcoming. Here is what is required, what…
-
A CBOM is useful when its evidence remains traceable
Why provenance, observation time, asset identity, and export scope matter as much as the component list itself.
-
A cryptographic inventory must be a system of record, not a spreadsheet
The minimum operating model for reconciling discovery, ownership, policy evaluation, and remediation state.
Talk to Vista
Bring your questions to the Vista team.
Ask about inventory, post-quantum planning, governance, and evidence.