Certes warns UK firms to adopt quantum security measures as it launches updated platform

In a move set to ease one of the most daunting challenges in cybersecurity, a new platform promises to protect businesses from the future threat of quantum computing attacks without forcing them into costly, disruptive infrastructure overhauls. Certes Networks has launched its v7 update, designed to deliver what it terms quantum-safe encryption across an organisation’s entire digital estate in a matter of days.

The Core Benefit: Speed and Simplicity in a Complex Landscape

The platform’s central pitch is rapid deployment. Where previous approaches to post-quantum cryptography (PQC) could entail multi-year projects involving network redesigns and application rewrites at a cost of millions, Certes claims its v7 can be operational within a week. Paul German, CEO of Certes, emphasises the shift in focus, stating the update allows organisations to safeguard sensitive information itself, wherever it resides, rather than just infrastructure and identity.

This speed addresses a pressing regulatory urgency. The UK’s National Cyber Security Centre (NCSC) has set out a clear roadmap, urging organisations to complete discovery and planning of their cryptographic systems by 2028, migrate critical systems by 2031, and finish a full transition to PQC by 2035. The NCSC prioritises critical national infrastructure—including healthcare, financial services, defence, and government—and warns that this global migration requires preparation to begin immediately.

For UK businesses, the complexity is compounded by a web of regulations like the UK GDPR, the Data Protection Act 2018, and the incoming expectations mirroring the EU’s NIS2 Directive. The financial stakes for non-compliance are severe: the Information Commissioner’s Office (ICO) has levied fines in the tens of millions, including £20 million against British Airways and £14 million against Capita for a 2023 breach.

How It Works: Achieving Quantum-Safe Encryption Without the Overhaul

The technical barrier has been a major deterrent. Widely used public-key encryption algorithms like RSA and Elliptic Curve Cryptography are vulnerable to Shor’s algorithm, which a future quantum computer could run. Certes states its v7 platform uses AES-256-GCM, an algorithm acknowledged by standards body ETSI as “Quantum Safe” because its symmetric key structure can be adapted, and supplements this with quantum physics in key generation and frequent key rotation.

Critically, the system is designed for what is known as crypto-agility. This means it can swiftly integrate new, certified cryptographic algorithms as they become available, such as those recently finalised by the US National Institute of Standards and Technology (NIST)—including ML-KEM and ML-DSA—which the NCSC recommends.

Dan Panesar, Chief Revenue Officer at Certes, summarises the practical benefit: “With v7 we help boards and CISOs move to quantum-safe data protection in weeks, not years, without refactoring applications, redesigning networks and infrastructure, or grinding operations to a halt.” He adds that this approach helps shrink the “blast radius” of any breach and reduces subsequent regulatory fallout.

A key feature for regulated industries is data sovereignty. The v7 platform keeps encryption keys entirely under customer control, with no visibility granted to major cloud providers like AWS, Azure, or Google Cloud. This meets growing demands from regulators in finance, healthcare, and critical infrastructure who insist sensitive data remains within jurisdictional control.

The Silent Threat: ‘Harvest Now, Decrypt Later’

The urgency for such protection is driven by a stealthy, long-term threat often called “harvest now, decrypt later.” In this scenario, threat actors steal encrypted data today, store it, and wait for the day when quantum computers are powerful enough to break current encryption. Experts believe commercially viable quantum machines capable of this could emerge within a decade, with some, like Google, warning it could happen as soon as 2029—a point known as “Q-Day.”

This makes today’s cryptographic decisions consequential for any data that needs to remain confidential for years to come. Certes frames v7 as a direct response to this threat, ensuring that even if data is exfiltrated now, it would remain secure against future quantum decryption attempts.

The update also explicitly covers the rapidly expanding use of artificial intelligence, protecting sensitive training data, prompts, and model interactions as more organisations pipe information through third-party AI platforms. This aligns with the UK’s voluntary Code of Practice for the Cyber Security of AI, which outlines principles for securing the AI supply chain under existing data protection laws.

Ultimately, the company’s argument is financial. A breach contained by its method of cryptographic micro-segmentation is positioned as vastly cheaper than one resulting in mass data exfiltration, multi-million-pound ICO fines, and severe reputational damage. With the NCSC’s deadlines on the horizon and the quantum countdown ticking, the platform offers a route to compliance that aims to avoid the operational paralysis many boardrooms fear.