The challenge? Managing the transition by turning risks into a manageable process
Sopra Steria, which operates in 30 countries, supports companies through a multi-stage process leading to the migration roadmap
Key points
The transition to post-quantum cryptography begins with a roadmap that businesses and organisations do not yet possess. This assessment is difficult to carry out because the cryptographic systems that protect data are not located in a single place. Rather, they are embedded in distributed IT infrastructures, layered over years of updates, managed by different suppliers and operating on individual applications or specific processes, which often involve separate functions.
The necessary steps
“Today,” explains Stefano Cazzella, CTO of Sopra Steria Italia, “no organisation has a centralised inventory listing all the cryptographic assets it uses. The first step, therefore, is to draw up this map, which is essential for carrying out a risk analysis and planning the transition in good time.”
Sopra Steria – a European group with 51,000 employees across 30 countries and revenue of 5.6 billion in 2025 – is working precisely in this area: transforming the post-quantum threat into a manageable challenge. The point is not merely to replace some of the current public-key encryption algorithms, such as RSA, with solutions resistant to quantum attacks, but, first and foremost, to understand in which business processes these algorithms are used, which certificates they protect, which data flows they involve, where the most sensitive communications pass through, and which data must remain confidential for the longest period. We need tools to analyse code, network scanners to detect protocols and traffic, and server audits to identify certificates and their level of protection.
Whilst the objective is clear, the path to achieving it is not always the shortest. The process is divided into several stages: it begins with defining the scope of the analysis, moves on to risk assessment, and then involves drawing up a migration roadmap. “Only at this stage can the first steps be taken, starting with priority services or individual applications and testing the implementation of the new algorithms and their compatibility with existing systems,” adds Cazzella.
There is also a second level at which the transition towards quantum-safe organisations is taking place. In addition to the field of post-quantum cryptography – which is based on quantum-resistant encryption algorithms that can be run on traditional infrastructure – there is the field of quantum communications, and in particular quantum key distribution (QKD): a secure communication method that exploits the laws of quantum physics to exchange a cryptographic key between two users in such a way that it is impossible to intercept without being detected.
