Keyfactor Tech Days 2025 brought together cybersecurity experts, innovators, and thought leaders for a deep dive into the future of digital trust.
No surprise, the hot topic was quantum!
From the rooftop welcome reception to smaller breakout rooms, there were plenty of insightful discussions, off-the-cuff moments, networking connections, and lots of humor. Here’s a look at some of the more memorable comments you may have missed.
Quantum Chaos: A Glimpse into the Future
- “In some respects, we’re already too late in starting the post-quantum migration.”
- “When it comes to quantum, you don’t have to be the fastest – just don’t be the slowest. Like campers outrunning a bear, staying ahead of the pack is what matters.”
- “Q Day? It’s a myth. The real threat is a slow drip of quantum-powered attacks over time. If your data’s already in the wrong hands, does it really matter if it takes seven minutes or seven months to decrypt? Waiting for a magic deadline is the worst strategy. Start planning today.”
- “Quantum-safe algorithms are like new house keys. The old ones don’t work anymore, but getting the new set isn’t as simple as clicking Buy Now.”
- “I’m seeing skepticism, which is healthy, but post-quantum has to be managed. Stop procrastinating. Start now. And don’t feel bad if you don’t have this planned – there’s enough horsepower focused on this problem and a network of support – it’s like the Kevin Bacons of quantum out there.”
Compliance and Digital Trust
- “For me, digital trust is about knowing who you’re talking to – you don’t trust who you don’t know. The same principle applies with digital experiences and we do that with certificates and keys, but quantum is putting that in jeopardy.”
- “It’s amazing how many companies I work with that don’t actually sign code!”
- “It’s all about the data…the data! It’s important to trust the metadata you’re generating; metadata you cannot trust can be dangerous. Signing protects the integrity of the metadata and apps. Signing is a step in many supply chain frameworks.”
- “A driver for the boards is compliance, so bring that to the board as you explain your rationale. The more you can tie cybersecurity to negative revenue impacts, the more they can wrap their minds around it.”
- “We actually get our board’s attention by having a very solid risk management team, and they help us formalize things with the right language that make sense for our interaction with the board.”
- “It’s a complex transformation. At the same time, the moment we have fear, uncertainty, and doubt doesn’t help. The biggest question is ‘where do I begin, and what does the board need to know?’ Start now, start very measured, and focus on crypto-agility.”
Post-Quantum: Challenges and Concerns from the Field
- “When we look at it from the boots on the ground, we’re seeing that post-quantum challenges have to do with…everything! Getting control of cryptography is the beginning, which is why maturity should have started a long time ago; 2030 is very closely on the horizon.”
- “We’re all talking about quantum like it’s five years away – but didn’t we say the same thing five years ago?”
- “I still believe that, eventually, the people who created the NIST standards will face issues, because having too many choices in standardization leads to confusion about what’s valid and what’s not.”
- “Harvest now, decrypt later – using architectures like one-time use keys can definitely help because the volume of harvest will be less. However, in times of panic, some people make the mistake of sharing encryption keys with all partners, which undermines the security benefits of quantum protection altogether.”
Navigating the Transition and Hybrid Strategies
- “From the FIPS perspective, confidentiality and integrity are critical. When working with vendors as trusted advisors, the goal is to guide them toward reliable solutions that align with NIST-approved algorithms, all while considering necessary timelines.
- “The ‘harvest now, decrypt later’ approach isn’t the only factor to consider – you must also balance confidentiality. For financial organizations, securing long-term signatures is essential. Operationally, this is what needs to be assessed.”
- “To ensure a smooth transition, you must protect software updates, or they become vulnerable. This means we need to start signing updates with cryptographically secure algorithms.”
- “Hybrid strategies or not?! There’s no choice for most organizations right now.”
- “Many companies are starting with hybrid approaches because they lack confidence in quantum-safe algorithms. Once they gain trust in the implementations, they may move away from hybrids. Different countries are pushing different directions, so the future is uncertain. Personally, though, I believe hybrid solutions are the way to go – for now, just make it hybrid!”
The Power of Connectivity: Global Collaboration and Trust
- “We’ve welcomed attendees from over 20 countries – and their commute is a testament to our reliance on a connected world. Authentication, integrity, encryption – digital trust is what enables connectivity. Most take this for granted.”
- “Critical connectivity requires critical infrastructure; Keyfactor is that critical infrastructure.”
- “Among Keyfactor customers, 1 in 3 are using multiple products, up from 1 in 10 in 2023. If you’re only using one, just know we have multiple products and solutions to consider.”
- “I think this is the most exciting time to be in cybersecurity. Keyfactor is here to partner with you, empower you, and we’re very thankful for the trust you’ve put in our company.”
PKI Party, Anyone?
- “Well, if there’s such a thing as Spring Break for PKI people, last night at LIV Nightclub was definitely it!”
Missed the fun? Check out some of the amazing moments in this highlight reel and stay tuned — we’re releasing on-demand recordings soon. Sign up here to be the first to know when the sessions are released!
