Meet CNSA 2.0 on the systems you already field.
Software-only, air-gap capable and self-managed: inventory cryptography across enterprise, tactical and platform networks, move key establishment to ML-KEM by policy, and file the evidence your inventory mandate requires.
Q-day is uncertain. The requirements for defense are not.
Nobody knows when a cryptographically relevant quantum computer will arrive (Q-day), but your cryptography requirements do not depend on that date. Four reasons to start now:
AI is already finding weaknesses in algorithms
Anthropic’s Claude Mythos preview found serious weaknesses in candidate algorithms without a quantum computer. Cryptography can fail before Q-day arrives.
Adversaries are harvesting encrypted data now
They are collecting classified traffic which stays sensitive longer than any quantum estimate, to decrypt when Q-day arrives: harvest now, decrypt later.
Regulators already require PQC migration
For a defense program that means CNSA 2.0 on new national security acquisitions from the gate date, the prioritized cryptographic inventory OMB M-23-02 and NSM-10 have filed annually, ML-KEM key establishment on high-value systems under EO 14412 and OMB M-26-15, and the inventory across every system type the DoD CIO memorandum extends to weapons systems and OT.
Estimates for Q-day keep shrinking
Google has set 2029 as the target for its own migration. If yours is not finished in time, the foundation of enterprise, tactical and platform networks is at risk.
Google’s 2029 target and resource estimates: QuSecure, April 2026. NIST IR 8547, initial public draft, November 2024. Anthropic, Claude Mythos preview, 2026.
Why use QuProtect?
Cryptography belongs in a layer you control and configure, not in application code.
No rewrite, no rip-and-replace
QuProtect moves critical and legacy systems to PQC in a fraction of the time and cost.
Discovery and remediation in one platform
Many PQC solutions stop at discovery and leave the fix to you.
Built for large, complex organizations with highly sensitive traffic
Developed with the U.S. Army and U.S. Air Force.
Nothing is re-coded
A program cannot take fielded systems out of service to re-code them, so QuProtect does not ask for it.
The next migration is a configuration change
It is made from an Orchestrator you control, not run as another program.
Proven in production
Banco Sabadell validated post-quantum TLS in four months.
Use case in action
Your network, from the cryptography it runs today to the policy change that keeps it current. Move through the five steps, or click a number on the drawing.
-
Tactical edge
- Disconnected edge kits cannot be upgraded
- Platform and weapon-system OT cannot be upgraded
- Satellite links
-
Classified enclave
- Mission applications
- Cross-domain gateway
-
Enterprise
- Agency enterprise services
- Contractor and DIB links
- Cloud (FedRAMP)
Legacy cryptography, and what Q-day does to it
Edge kits and platform OT reach mission applications on the TLS they were fielded with, and the cross-domain gateway reaches enterprise services and contractor links on TLS 1.2 with RSA key exchange. Traffic recorded today can be stored until a quantum computer running Shor’s algorithm recovers those keys, and classified traffic stays sensitive longer than any quantum estimate.
Sensors find the legacy negotiations and rank the violations
Reconnaissance sensors read what is on the wire, inside the enclave, and record the cipher suites, protocols, certificates and keys in use, without touching a system. Each policy violation is ranked by severity: the edge and platform hops first, RSA key exchange on the enterprise crossings next.
Encryptors remediate at the network layer
A gateway in front of the edge kits and platform OT and sidecars beside the mission applications and the cross-domain gateway carry each hop over TLS 1.3 with NIST post-quantum key exchange, ML-KEM-1024 where CNSA 2.0 applies and X25519MLKEM768 elsewhere. No recode, and the Orchestrator runs inside the enclave, so nothing leaves it.
Data in transit is secured, and the CBOM proves it
Traffic recorded from now on is not readable by a future quantum computer. The CBOM lists each connection’s protocol, algorithm and certificate with no open violations, with owner and criticality, in the form the annual inventory filing asks for.
Crypto-agility: the next algorithm is a policy change
When the standard moves, or an algorithm is compromised during an operation, the Orchestrator pushes the new policy to each encryptor and the connections renegotiate while the mission continues. The change is made by policy, not by a program office.
Other use cases
Inventory across enterprise, tactical and platform networks
The prioritized cryptographic inventory OMB M-23-02 and the DoD CIO memo require, weapons-system and OT links included.
ML-KEM on high-value systems
EO 14412 and M-26-15 key establishment applied at the network layer, no recode.
Air-gapped deployment
The Orchestrator runs inside the enclave; nothing leaves it.
FIPS 140-3 mode
A validated mode of operation with classical interoperability alongside post-quantum algorithms.
CNSA 2.0 by policy on national security systems
Key establishment and signatures set by policy and enforced on each connection in scope.
TLS 1.3 on legacy systems
EO 14144 met by carrying systems that cannot upgrade over TLS 1.3 at the network layer.
Tactical edge and satellite links
Disconnected kits and non-terrestrial links behind gateway encryptors.
Evidence for the annual filing
Logged handshakes and a CBOM with owner and criticality, exported for the inventory filing.
Defense case study
Live post-quantum sessions for legacy satellite links.
The Fast Mode on the end-to-end satellite link, and what it means for aerospace, defense, finance, healthcare and IoT transmissions.