Approve a bank login with UAE Pass or open a service on TAMM, and the whole process takes a few seconds. What you do not see is the layer of security that makes those seconds trustworthy.
The moment you connect, your device and the government service establish a cryptographic handshake. They create a shared secret, verify the service’s digital certificate, and establish an authenticated encrypted channel before sensitive information is exchanged. That process protects your data and ensures you are communicating with the genuine service, not an imposter. It relies on public-key cryptography, specifically algorithms such as RSA and elliptic-curve cryptography (ECC), which underpin almost every modern digital government service.
It is a layer of technology that has done its job so quietly, and so reliably, that few people outside cybersecurity ever think about it. Now it is being rebuilt.
Today’s public-key cryptography is secure because the mathematical problems behind it are effectively impossible for conventional computers to solve within a practical timeframe. A sufficiently capable, fault-tolerant quantum computer running Shor’s algorithm would change that. It could solve those problems within practical timeframes, undermining the cryptographic systems used to establish trust and secure digital communications. No such machine exists today, and estimates for when one might arrive vary widely, which is exactly why the arrival date is the wrong thing to plan around.
Replacing cryptography across an entire national digital estate is a multi-year undertaking. The clock that matters is not the countdown to a quantum computer capable of breaking today’s encryption, but how long the migration itself takes, and every month spent without a plan comes off that runway.
The risk is not only future attacks. Adversaries can capture encrypted communications today and store them until quantum computers become capable of decrypting them, a strategy often described as “harvest now, decrypt later.” For information that must remain confidential for years, the transition has already begun.
Transformation is outrunning its foundation
This is one of the largest technology transitions governments have faced because public-key cryptography is woven throughout digital infrastructure rather than confined to a single system. It protects digital identities, certificates, VPNs, payment systems, software updates, cloud services, firmware inside connected devices, and the digital signatures that establish trust across government systems. Much of it sits inside legacy platforms or commercial products that governments do not directly control.
The challenge is also more focused than many people assume. Symmetric encryption, which protects stored data, remains comparatively resilient against quantum attacks and can generally be strengthened by using larger key sizes. The primary exposure lies in public-key cryptography, the technology used to establish trust, authenticate identities, exchange cryptographic keys, and verify digital signatures.
Fortunately, governments no longer have to wait for the standards. The first generation of international post-quantum cryptographic standards is now available, giving organisations a clear destination for migration.
Yet many organisations cannot begin that journey because they lack a basic inventory of where cryptography is actually used.
Every new application, citizen portal, digital identity platform, or connected device adds another layer of cryptography that will eventually require migration. Many organisations can identify their critical applications but cannot confidently answer more fundamental questions: Where is cryptography being used? Which algorithms are running? Which systems depend on them?
Cryptographic discovery: The first step
Cryptographic discovery is a read-only exercise. It does not touch a single running service. Done well, it examines network traffic, certificates, cryptographic libraries, source code, software dependencies, cryptographic APIs, and key management systems, surfacing cryptography in the places people forgot it lived: keys hardcoded into applications, certificates trusted for years, libraries buried inside operational equipment, and outdated algorithms embedded deep within commercial software. The result is a complete inventory of every cryptographic asset, algorithm, certificate, and dependency mapped to the systems that rely on them.
You cannot modernise what you cannot see. Before organisations can plan a post-quantum migration, they need visibility into where cryptography is being used, which algorithms are deployed, and which systems depend on them. Cryptographic discovery provides that foundation, transforming what would otherwise be a complex migration into a structured, risk-based program.
This is already happening at national scale in the UAE, where the Cyber Security Council and QuantumGate have partnered to automate cryptographic discovery across complex national infrastructure, providing organisations with visibility into the foundations of digital trust before migration begins.
A single scan does not stay accurate for long. Certificates are issued and replaced, systems scale up and down, software is rebuilt, and a vendor update quietly swaps one algorithm for another. Within a release cycle, the picture is out of date. Discovery therefore has to run continuously, built into software development, certificate lifecycle management, and operational processes so weak, vulnerable, or expiring cryptography is identified as it appears. Much of the value is immediate, regardless of the quantum timeline: improved certificate management, fewer outages caused by expired certificates, stronger compliance, continuous audit readiness, and ongoing visibility into an organisation’s cryptographic posture.
Designing for the next transition
The systems being built now will determine how manageable the next change is. Build them so the choice of cryptographic algorithm is a configurable policy rather than an assumption embedded in application code, and the next transition becomes an upgrade instead of a rebuild.
During the migration, systems can operate in a hybrid mode that combines classical cryptography with post-quantum cryptography. For example, a classical key exchange mechanism can run alongside a post-quantum key encapsulation mechanism, ensuring that communications remain protected unless both approaches are compromised. This enables organisations to adopt quantum-resistant security while maintaining interoperability with existing infrastructure.
For systems that cannot be modified directly — mainframes, industrial control systems, operational technology, and vendor appliances — the practical approach is often to deploy quantum-safe gateways that protect communications without requiring changes to the underlying applications.
Trust is becoming a national capability
As governments continue to digitise essential public services, cryptography is becoming a matter of national capability rather than simply an IT function.
The ability to discover, manage, and modernise cryptography within national borders helps governments maintain visibility over critical digital assets, certificate infrastructure, and trust services that underpin everything from citizen identity to financial transactions.
Countries that can demonstrate confidence in the security of their digital foundations will be better positioned to attract investment, protect critical infrastructure, and strengthen public trust in digital government.
Cryptographic resilience is not a destination that governments eventually reach. It is an ongoing capability that must evolve alongside the services it protects.
Citizens rarely think about the cryptography behind the services they use every day, and that is precisely the point. Trust works best when it is invisible. The governments that invest in protecting that invisible foundation today will be the ones their citizens continue to trust in a post-quantum future.
