Harvest Now, Decrypt Later: Why Post-Quantum Security Can't Wait | Eddy Zervigon

Russ Fordyce (00:00): Welcome back to the Winner Circle, everybody. I am here today with Eddie from Quantum Exchange. He is the CEO trying to help enterprises really get secure around this great quantum threat that we have. We had we're talking about all this AI stuff, and we're giving AI all this new access to all our information and all our tools. And pretty soon somebody's going to cross that quantum divide. Eddie, welcome to the winner circle and congratulations on the award. Eddy Zervigon (00:26): Thank you so very much, Russ. We're honored to to accept such a prestigious award from your team. Russ Fordyce (00:31): Yeah, well, the Fortress Cybersecurity Awards have been a around for I think 13 years, 12 or 13 years now. And we have seen a massive shift almost threefold. Like right, you know, the 13 years ago, 12, 13 years ago, we were worried about IP attacks and man in the middle attacks and SMS and you know everybody talking about du you know dual encryption or dub or dual authentication. Now we're talking about AI, and now we're gonna be talking about quantum. Give us a little bit of background about quantum exchange, give us the elevator pitch on what you guys are all about. Eddy Zervigon (01:06): Sure. so Quantum Exchange has been around since about 2017, 18, and it was really organized after n the announcement that NIST would kind of lead the way on developing or at least validating the next generation of algorithms that would take us into the post-quantum age. So they started this large, large process of taking input from all over the world on what would be the next a generation algorithms. And resulting in twenty twenty-four with the first algorithm to come out of this analysis, which is ML CAM ten twenty-four. And so what we were founded on was the concept of this is not about algorithms. The algorithms will come and go. this is really a a question of meeting the moment, meeting the threat with an architectural solution that'll allow you to adjust on the fly without bringing down your network, which is incredibly important, right? True crypto agility. without bringing down the network and being able to as a result being able to really plug and play algorithms as as events warrant and as NIST comes out with new ones. Russ Fordyce (02:14): Yeah, and so we've been we've been struggling this with this exact problem for decades, right? As long as encryption's been around, we've gotten tighter and tighter, harder to crack encryptions as as computers get faster and faster. They're able to break these algorithms. And the algorithms are just a series of numbers and letters in a string, and they keep getting longer and longer and longer so that it's harder and harder to crack them. And unfortunately, when quantum happens, pretty much everything's going to be crackable that we have today, right? I mean, it's it seems like this is. As you say, it's you know, it's these algorithms are just gonna keep popping up as as attacks keep getting more sophisticated. Eddy Zervigon (02:50): That's right. And I think when you couple it with AI, as I like to say, AI is the brains and quantum is the brawn. And when you put them two together, we we have absolutely no idea how those two children are gonna play in the playpen, but we know it's gonna be catastrophic. So as we like to advocate it, this is about architecture. If you cannot put together the the proper architecture to meet the moment, then we're gonna fail. And this is if you think about encryption is everywhere. Everything that we do in the digital world has some level of encryption. It's been embedded because it's easy. And so now we've got to really take a whole cloth look at this and say, okay, what's the inc what's the architecture that's going to guide us for the next fifty years? Russ Fordyce (03:33): Yeah, now you have an interesting background here. What drew you personally into this problem? You know, encryption and quantum security after a career that started in investment banking. how did you how did you land here? Eddy Zervigon (03:46): it's a good question. because there's nothing in my background other than having been an inve investor in what I would call missions of consequence businesses. Like I was an early on investor at Morgan Stanley on behalf of Morgan Stanley in a company called Digital Globe, which was the first commercial remote sensing company. And then another company that's been in the news a lot lately, Bloom Energy, led their Series D investment back in 2008 at this point. Two thousand and seven, sorry. It's gonna be twenty years next year. And and so I really love investing in in businesses and working with businesses that it's not just about baking making money, but it's about really doing some things that I think, but not for the business. things could end up very differently. And I'm very excited about what we're doing here with quantum exchange. And when I was brought on six years ago to take what we think is really, really innovative technology and commercialize it, I jumped at the chance to bring kind of my my Russ Fordyce (04:15): Wow. Eddy Zervigon (04:42): background of many years in terms of working with founders and investors and taking companies from from technical proof of concept to product market fit and then scaling them. Russ Fordyce (04:55): Yeah. Well, this it seems like, you know, right time, right place. You guys, you were to you talked about it earlier. You have this architecture solution to this problem, which is, you know, I think as I understand it, kind of the control plane and the data plane and the I guess the security plane has all been one in most of these scenarios. And you're actually recommending splitting it off, or in practice, sp splitting it off into its own kind of channel. We did this in fiber. And an IP a long time ago we had signaling protocols that ran on different channels and stuff like that, literally probably for this problem. How come it took so long for, you know, kind of the rest of the industry to kind of realize this was a better approach? Eddy Zervigon (05:35): Well, w the I I don't know if the industry has completely realized it yet. And that's part of my job and part of our job is to advocate that this is about architecture because for fifty years it's been so easy to just embed it in the endpoint. Why? Because we had Moore's Law to tell us over what period of time compute power was going to get to the point that we would be defeated in terms of our algorithms. And fortunately for us, it's an incredible technological run that for fifty years we've basically been governed by three algorithms that have kind of helped us secure the digital world. But we're no longer going to have Moore's you know, Moore's computational ability, and we're no longer going to have that that that algorithm path, if you will, that we can rely on. And so that's why it's important for us to morph into, okay, if we if we can't rely on the algorithm 100%, then let's at least put in place an architecture that is robust, that allows the change on the fly. without having to bring down the network. And that's very, very important. Because the reason why all these vulnerabilities exist from patches and and and whatnot amongst the different gear manufacturers and vendors is because no one wants to bring down the network to update. Just think about your iPhone or your your your Android device. When you get that message that says that you need to update your your device tonight and we're going to do the update tonight while you sleep, just make sure it's powered in, you know that's not a message you want to receive. You're looking at it going, Got. I know tomorrow there's a bunch of things that aren't gonna work. There's a reason why we don't like patching because there's a bunch of side effects that happen as a result. And therefore, we want to make sure that it's easy to swap in and out of algorithms. And you're not gonna feel like an algorithm is deprecated. Now I'm I I've my choice is either stay with the deprecated algorithm. Or bring down my network. That's not a that's not a good choice for network operators, certainly in high value assets in the federal government to have to make. Russ Fordyce (07:32): no, you I I was talking about that exact thing with somebody the other day of, you know, just a an hour of downtime for a bank on a system could be billions of dollars, you know, in transactions that are delayed or never happen or whatever. So you t you take that into the government realm and it's it's a completely different or military realm, it's a completely different set of circumstances. But post quantum seems to have been this like kind of, you know, term that we've been hearing as kind of coming soon for. decade more? I've heard that, you know, a lot of people are speculating that we're gonna get to that quantum era by the end of this decade. What do you think is the likelihood of that? And why do you think people are still kind of under prioritizing this kind of, you know, what I think is pretty dire need if we're, you know, four years away. Eddy Zervigon (08:21): Well, because I think people have this kind of view of looking at the quantum threat as as why as we looked at Y2K. It's a moment in time and when it happens, we have to be prepared for that moment in time. And what I would argue is it's happening today. If you think about a harvest now decrypt later threat, that means that our adversaries are are s are are storing the data as they traverse our data planes. And for the day in which they will have a cryptographically relevant quantum computer and can break that encryption and replay it and have it. And so it it's really a a a threat that's being stolen today but won't be realized until the future. And the other part of this is the folks that are that are aiming to be able to do this aren't going to tell us when they actually have a cryptographically relevant quantum computer. So you can't you can't count on someone raising their hand and go, Okay, guess what? We can do this. So we have to really prepare today. And and that's part of what we do at Quantum Exchange. We think we have a fantastic architectural solution to it, but you've got to make the case to the consumer, to the CISO, to the CIO, to the CEO, to the board that ultimately this is about architecture and just popping in a new algorithm that you think is gonna make sense may not. Russ Fordyce (09:36): Yeah. What so walk us through what actually happens if an organization does nothing. What's going on today and what's kind of the you know, what's what's the what's it look like with something that you're talking about with this architectural solution where, you know, you can effectively slipstream these these objects. Eddy Zervigon (09:51): So I think the plan had historically been let's understand what's the cryp cryptography that's currently being used in the network, where our endpoints are, what cryptography is being used, and take an inventory, if you will, of that cryptography so that we can, in a staged process, be able to roll out post quantum encryption over a long period of time. But in the meantime, as we know, the market doesn't really care what people think or plan. And so The folks that have been spending billions and billions of dollars, the IBMs, the Microsoft, the Googles, the Alphabets, they are making incredible progress on being able to develop a commercial quantum computer. If we're making progress, I could assure you our adversaries are as well. And so what's happened is that market, that that time to market has moved to the left much faster than anyone had previously thought. And as a result, It's no longer, we don't have the time, we don't have the luxury to sit and inventory every single endpoint. What we advocate is let's find the the the largest pipes carrying the most important pertinent data for ourselves and lock those down, right? Because you can solve for every single application, every single endpoint, but but if you capture the the big data lines, right, the big network transport lines, right, that is in That is actually encapsulating all those different application elements, then we're we're we're vast majority of the way there to solving this problem. And so you don't have to have this step function in order to get to a successful point. You just need to be able to understand where your weak points, your vulnerabilities are, and be able to do something about it. Russ Fordyce (11:37): So we have all these endpoints with with the algorithms that we have today, right? Why is migrating to this new cryptography so much harder than people assume? What's what's the part that actually catches organizations off guard? Eddy Zervigon (11:52): Because it's hard. It it's hard to go through a refresh cycle. And as I'd like to say, you're actually doing something that before no one really had to do. You you just assumed encryption worked, as I as I mentioned earlier. It it's one of the most successful technological runs we've known, right? Fifty years we've relied on three algorithms. So the algorithm is put in place. We don't even know. I mean, if you ask most CISOs of Fortune five hundred companies what algorithms you're running, where they're they have no idea. It's a it's a set it and forget it mentality. And so that's not gonna work for post-quantum crypto, unfortunately. Right. So we have to take an active role, take active management control of our post-quantum cryptographic architecture. Because if we don't, then you know, as I like to say, even though even though for us it's kind of like asking someone to buy a steering wheel for a car, right? And they'll say, Well, I've never had to pay for a steering wheel in my car. Why do I have to do it now? Because the steering wheel is going to fall off. And so, as difficult as it may sound and and as many priorities as a CISO, and and and don't get me wrong, there's a reason why public company CISOs only last less than 24 months on average. It's a hard job. You've got phishing attacks, you got ransomware, you got denial of service, but you gotta be able to walk and chew gum at the same time. And this is incredibly important because the franchise value and the franchise risk at play here is enormous. Russ Fordyce (13:21): Yeah. Now you've you also talked about your solution kind of dramatically reducing the timelines of doing this. What I guess I'm struggling to understand what are the timelines involved, what's the kind of activity involved in switching out an algo that now you're able to do in, you know, in days that used to take weeks. Eddy Zervigon (13:38): Well for us, once once you take the initial hit of of the of implementing FIOTX, then it becomes very, very easy. And even the the migration to a FIOTX, because it's an overlay over your existing network, is pretty easy to to do. The the the it's an initial upfront cost in terms of development, and then after that it becomes a question of Just being able to run it on itself and being able to audit, automate it, all those things. Russ Fordyce (14:10): How often do you do you see this change? If NIST has this algorithm, I would imagine that, you know, as time goes on, it's gonna get updates pretty often. Is that is that kind of in the plan? Is that is that kind of what goes on? Is it is it a three month cycle, six month cycle or on demand? Eddy Zervigon (14:26): Well, as far as we know, NIST is done with the with the post quantum key encapsulation method algorithms. So they've delivered two. They've delivered MLCM 1028 and HQC. And so for us, I look at it and go, That's it. That's all we got. Like, you know, what's the likelihood that the two algorithms out of the box are gonna be the ones that are gonna take us into the next fifty years without ever having seen a post a cryptographically relevant quantum computer and much less the interaction that it's going to have with AI. So I would say I I I think there's gonna be more. And so let's prepare for it. Russ Fordyce (15:06): Yeah, I I it it it seems like this thing ought to be on GitHub. You know, or be part of like, you know, in the in the internet world, we have a system that's updated all the time. It's DNS. Right? It's it it's updated, you know, a bazillion times a day, an hour, a minute. and I'm wondering if it it'll end up turning out something like that. Because I mean, I'm just you know, the cracks in the armor have got to be you you've got to I would imagine you have a large hump of to get over. Eddy Zervigon (15:23): Yeah. Russ Fordyce (15:34): you know, whatever this algorithm is, but once that hump's over, it just seems like it there's gonna be updates galore. Eddy Zervigon (15:42): Yeah, and that's why I think you take the initial hit and you you you swap over and you you bring a a a solution like a FI OTX and then the rest runs itself. I mean one of our one of our mantras, if you will, is change nothing, change everything. And and the less you can do up front, right, to make it easy for the the CISO, the CIO to be able to actually control right algorithms and control their post quantum. Russ Fordyce (15:52): Yeah. Eddy Zervigon (16:08): cryptographic journey, right? And be able to audit, automate it, be able to do the things that that we've always been able to d do. And I and I use as a as a reference point identity and access management. We all were old enough to remember when you would join an organization and you would get a username and every single application that you used had a username, password, all that stuff. And then somebody came with the brilliant idea of let's control it from the top. And that became identity and access management became a multi-billion dollar industry. And so we're we're looking to do the same thing, control it from the top. Russ Fordyce (16:43): Yeah, and that's become the the weak point of pretty much everybody's infrastructure is that access point. When you're you're out talking to CISOs, to security teams, you know, every day, every hour to investors, are they skeptical to kind of touch their existing encryption inf infrastructure? Eddy Zervigon (17:02): Sure. The the hardest person to get through is the the network engineer who runs that network. They're like, no, you you have to be able to demonstrate that you do something nobody else does. You're not gonna destroy my network, right? And you can scale. And if you can't do those things, then you know it it becomes a much tougher sell. But when you look at what we're able to bring to the table, the only PIPS validated one forty dash three, two three solution, we're now very close to getting European Union common criteria. Right. I think we've been through the hoops in terms of validating what we do, our technology. And so I think that gives a CISO a CIO comfort that when they deploy quantum exchange, when they deploy FIOTX, they're going to be able to really inject a new control plane, if you will, for post quantum crypto that's going to work in tandem with their current network and not slow it down in any way. Russ Fordyce (18:00): Yeah, what do you think it looks like for like the next two years as they as they, you know, really kind of do pressure the Fortune five hundred and all the federal agencies to kind of do this migration? It seems it it seems like it I good for you, but it seems like it could be very chaotic. Eddy Zervigon (18:10): So Eddy Zervigon (18:16): I I think it will be, but it as always it starts just like two factor authentication started with the federal government and and and rules and regulations and compliance for federal agencies. I think it's gonna be the same thing here. the there's a there is a difference though. We're seeing the timelines move much more to the left, much faster than the budgets are, right? And with the with the let's be charitable with the chaos we see in DC these days. My biggest worry is that we're not gonna have budget that coincides with the timelines, right? And the and the and the threats that we're facing. But I think once they get that together and they understand that this is a a problem that needs to be solved today, I think you're gonna see it move much, much much more quickly than probably it would have two, three, four years ago. And then I think it's gonna stretch not only to Fed Civilian DOW, but then you're gonna start getting into critical infrastructure, healthcare. financial services where it's clear that these are going to be very, very important threat vectors that we need to secure. Russ Fordyce (19:21): Yeah. Now i if you're, you know, if you're gonna tell w an executive one thing that they should be focused on, even if they don't have a security leader leader in their organization, we we talk with a lot of smaller businesses, a lot of medium sized businesses about this quantum threat. How would you kind of guide them in the next kind of couple of years? Eddy Zervigon (19:41): I I would say you start with the biggest pipes that you got, right? And and the data like anybody who's not looking to actively secure the pipe between backup and data center, that that to me is just that's malpractice, right? If you're a CISO and you're not focusing on that, you're not focusing on the big pipes that are carrying the most important data, right? That that you cannot have available to an adversary. Right. And then you work your way down. Then you could start thinking about your inventory and you could start relying on some of the vendors. But you have to I I think if there's one message that your your your viewers have to take is that you have to take control of your own cryptographic journey. You cannot allow it to stay in the hands of the vendors because ultimately they have to they're they're selling boxes, they're selling solutions that that that that I think move the needle for them, but they may not be. on your timeline. They may not coincide with your refresh schedule. And so it's very important that you take control of that process. just like you would identity and access management, just like you would network security, any network security device. You gotta understand what's what's being done and how you can affect change if you need to. Russ Fordyce (20:56): Well, and as you said, this AI world is just making this all the more difficult on both on on every aspect of it. I mean, it's great for us, but Lord, I have given my password and credentials to so many systems these days that it you know it it it really it really is a little scary even for me. You know, it's like how how do you kind of rein that back and and and and bring that security back in? And I I imagine that we'll work that out as we get into this agentic world. When you're when you're with a customer. And you're trying to work through kind of that network migration to this kind of post-encryption model. How do you help them figure out kind of what data actually needs to be quantum safe versus kind of what can wait? Eddy Zervigon (21:37): Well, there is the the theorem, Moscov, right, I believe is his name, who developed a theorem that said you have to look at it in terms of when you think a rele a cryptographically relevant quantum computer, the three variables to the theorem, right? When do you think a cryptographically relevant quantum computer will be available? What's the time that you need to move to or mitigate the the threat with post-quantum crypto in your network architecture, right? And how long you want to keep your data safe for. So if you want to keep your data safe for seven to ten years, I believe you're already compromised as you rela as it relates to that. If you want to keep it, you know, safe for one year or one day, then maybe you have some time. So it's up to the CISO, the CIO, the CEO boards to determine what that sensitivity is surrounding how long we need to keep this data safe because it's it's a problem that's coming. Russ Fordyce (22:29): Well, and it it well, and it amazes me because I think what NIST has said is actually that they you know, they're gonna do this kind of phased rollout and it's gonna take ten years. And and to me it's like, Wow, you know, we could be five years into this or six. and rollout's gonna be taking another, you know, three or four years. That's gonna be a real problem. And I think we're gonna have to start thinking about what data. because if we can't get to everybody, you're gonna have to get to a little bit to everybody. Eddy Zervigon (22:59): Well, the executive order is clear. If you if you run a high value asset network or high value network for the US government, you've got to migrate by December thirty first, twenty thirty, as it relates to the key encapsulation and twenty thirty one if it relates to the signature. So that's not a lot of time. It is. And every day it's getting faster. Russ Fordyce (23:16): Right. It is it's coming faster than you think. Yeah. How do these standards bodies, you know, likeness kind of affect your own product roadmap? Eddy Zervigon (23:27): Well, the beauty of what we do is the as as I get asked from CISOs and CIOs and you know and and and the thought is how do you compare versus this team or that team or that company, that solution? And I would say, look, the first thing you need to ask is is the solution based on standards? Certainly in the US and NIST would be, right? So if it's based on MLCM 1024, HQC, then that's the first step. Then the next step is, is it validated and by whom? So is it FIPS validated? Is it European Union common criteria? Is it you know commercial solution for classified? Who's validated it, right? If if if you can't get through those two, then I d I think you need to start start from the top again with a new vendor and and and figure it out. But those are those are the two things that I would start with in terms of what you what folks should be looking at. Russ Fordyce (24:19): And it it what's interesting to me is you were you were invited to Congress to testify before them about quantum security. And the White House has actually been pretty aggressive at making it a kind of a top federal kind of priority is to is to really get on top of this. And we've talked about the NIST standards being pushed out. What do you think the policymakers still misunderstand about this space? Eddy Zervigon (24:42): You gotta apply the budget to the timeline. If you when the budget timelines without budget is wishful thinking. And so that's what I spend my time, that's what we spend our time in Washington saying that's great. Really, I've we love the direction of where this is going. I I wonder if they have a I mean, they're gonna have a better understanding of the real underlying threat than than than the public will. So my concern is okay, clearly you're doing this because you're seeing something that the rest of us aren't at this moment, other than what we're being told by Google, you know, IBM and and others that this is happening much faster. But without the budget to meet the timeline, i i what are we doing? Russ Fordyce (25:25): Is there is there a specific policy change that you'd like to see that would make, you know, meaningful progress on that, or is it just strictly call your senators and get to pay more attention to budget items around security? Eddy Zervigon (25:38): Well, that that always helps, right? but but the the thing from a policy perspective, one of the things that we really are staunch a staunch advocates for is the separation of key generation and delivery from the data plane and and putting it in its own control plane. Because as I said in my congressional testimony, innovative solutions require innovative timelines, right? And and and startups don't work in this five, ten year, we just don't have the luxury, right? We develop really, really unique, interesting technology and we expect that the marketplace is going to understand that technology and consume that technology in a reasonable time frame. If not, then we're a think tank and this is this is way beyond think tank. Russ Fordyce (26:21): Well, I th I I think you're getting there. I mean, we've got words like crypto agility that are starting to be buzzwords in the industry and and somewhat kind of creeping out of the industry. When it reaches the Simpsons, we'll know it's really popular. but is is that something that customers are actually asking for by name? Do they want to be crypto agile? Eddy Zervigon (26:33): Well Eddy Zervigon (26:40): Well, Russ, that's a great point because this is something that, again, we really spend a lot of time. W how do you define crypto agility? Your crypto agility may not be my crypto agility. And we've written a really, really good piece, which I'll share with you regarding the crypto crypto agility and how to define it. And for us, crypto agility is being able to hot swap an algorithm and and not having to and not having to bring down the network as I talked about. If you have to bring down the network, then we get back to what we were talking about before. It's it's not gonna happen. And you're gonna have you're gonna have all kinds of data out there with deprecated, even busted algorithms. and and so for us, crypto agility is defined very differently than other people. Other people define crypto agility as having basically a a a a library of post quantum algorithms that you can swap in and out of. That's great. But if you gotta bring down the network to do it, that's not crypto agile that may be crypto fragile. Russ Fordyce (27:41): I I like the turn of phrase there. Eddie, thank you so much for joining us on the winner circle and congratulations on all the success with the awards and everything else and investors and customers and everything else. It's really it's really fun to watch this space and seeing you guys succeed. Eddy Zervigon (27:45): Thank you, Ross. Eddy Zervigon (27:55): Thank you so very much. We're very proud of our progress and really appreciate your support. So thank you.