SpecterAI’s Huynh says banks must test quantum defenses now

Quantum‑Ready Banking: Why Action Can’t Wait

Financial institutions rely on RSA and elliptic‑curve cryptography to secure everything from TLS connections to transaction signatures. Dr. Peter Huynh, SpecterAI’s Quantum Security Chairman for APAC, warned at HPT D‑DAY 2026 that adversaries are already harvesting encrypted traffic with the intention of decrypting it later once quantum computers become powerful enough. This “harvest‑now, decrypt‑later” threat makes quantum readiness a matter of timing, not speculation.

---

1. Map the Landscape – A Full Cryptographic Inventory

The first stage of SpecterAI’s five‑stage framework is a comprehensive inventory of every cryptographic asset. Banks often focus on network firewalls, overlooking hidden libraries in mobile banking apps, firmware in ATMs, and key‑storage modules. Identifying every RSA, ECC, and symmetric key instance creates the baseline for risk assessment.

2. Classify Data by Longevity

Not all data carries the same confidentiality window. A one‑time password may only need protection for minutes, while mortgage contracts or biometric templates must remain secret for decades. Huynh emphasized that biometric identifiers cannot be changed, making them high‑value targets for future quantum attacks. Classifying data by required secrecy duration informs prioritization in later stages.

3. Assess Exposure and Prioritize Hardware Security Modules

Exposure assessment shifts focus from sheer visibility to actual risk. Hardware Security Modules (HSMs) often lack support for post‑quantum algorithms, creating an immediate bottleneck. If an HSM cannot run ML‑KEM, ML‑DSA, or SLH‑DSA, any downstream migration will stall. Prioritizing HSM upgrades or replacements therefore accelerates the overall timeline.

4. Migrate with Hybrid Cryptography and Crypto‑Agility

Hybrid schemes—such as combining X25519 with ML‑KEM‑768 within TLS 1.3—allow organizations to retain compatibility while introducing quantum‑safe primitives. However, Huynh cautioned that a hybrid connection can silently fall back to classical algorithms if a partner’s system lacks post‑quantum support, giving a false sense of security. Designing systems for crypto‑agility—where algorithms are configurable rather than hard‑coded—prevents this regression.

5. Independent Validation as the Final Gate

Internal testing rarely uncovers the very weaknesses a system’s designers have built in. Huynh argued that “no organization can independently validate work it performed itself.” Independent auditors, ideally with expertise in both classical and post‑quantum cryptography, must verify that every component—from key‑generation services to API endpoints—meets the quantum‑safe criteria. Continuous validation is essential as software updates, third‑party integrations, and new threat intelligence emerge.

---

Managing the Timeline: The X + Y > Z Equation

Professor Michele Mosca’s framework frames risk in terms of three variables: X (the time data must stay confidential), Y (the time required to migrate to quantum‑safe systems), and Z (the estimated arrival of a capable quantum computer). If X + Y > Z, the data is already at risk. The only lever banks control is Y—how quickly they can execute a disciplined, staged migration. Starting the program now compresses Y, keeping X + Y < Z and preserving confidentiality.

---

Practical Steps for Banking Leaders

1. Commission a cryptographic inventory across all digital channels, including legacy ATMs and mobile SDKs.
2. Tag data by confidentiality lifespan and prioritize protection for long‑term assets.
3. Upgrade or replace HSMs that cannot support NIST‑standardized post‑quantum algorithms (ML‑KEM, ML‑DSA, SLH‑DSA).
4. Implement hybrid TLS configurations with clear fallback policies that reject non‑quantum‑safe connections.
5. Engage an external quantum‑security validator to conduct a full assessment and establish a continuous validation cadence.

By following these stages, banks can shift from reactive panic to proactive resilience, ensuring that today’s encrypted transactions remain secure even in a future where quantum computers can break classical cryptography.