A new map tackles the first quantum-security problem: where to start
Horizen Labs’ free guide separates the jobs involved in changing encryption, but its listings are not product certifications.
Reading tools for text size, copying, printing and your reading list
Preparing for quantum computers is not simply a matter of buying a new security product. A free map launched by Horizen Labs on November 12 tries to make the work easier to navigate, organizing providers by the task they help with and the systems they cover.[1]
The company says its Quantum Security Ecosystem Map launched with 75 providers. It is a directory, not a stamp of approval: the site explicitly says its provisional placements are neither endorsements nor certifications or technical assessments.[1][2]
The map divides migration into five stages: discovering existing cryptography, assessing risk, adding interim protection, replacing vulnerable algorithms and maintaining the resulting systems. It applies those stages across eight layers, from chips and connected devices to applications and AI systems.[2]
That structure offers a useful way to read a crowded market. Finding encryption in software is a different job from replacing the certificates that establish a service’s identity. Updating a network connection is different again from deciding what to do about sensitive backups. A product that helps with one task does not necessarily complete the migration.[2]
The underlying standards are no longer hypothetical. In August 2024, the US National Institute of Standards and Technology finalized its first three post-quantum cryptography standards and urged administrators to start integrating them, warning that the transition would take time. These are mathematical tools designed to resist quantum attacks, used on conventional computers.[3]
Horizen’s map can help readers form better questions, but it cannot answer whether a particular product meets their needs. Vendor placements can be corrected, and apparently empty categories should not be mistaken for proof that no solutions exist.[2]
The next useful step is checking a shortlisted supplier’s actual supported algorithms, interoperability and independent evaluation, rather than treating a directory entry as evidence of security.[2]