Quantum safe
Post-quantum security, from planning to implementation.
Southern Cipher Security helps APRA-regulated entities, critical infrastructure operators and Commonwealth agencies secure their cryptographic estate against quantum threats. We enable Australian organisations to identify their cryptography, plan the transition to post-quantum cryptography and implement the change.
Book a 30-minute consultationA PQC expert-led conversation. You leave with a view of your likely exposure, the milestones that apply and a proportionate first step.
Sovereign. Expert-led.
ASD recommended milestones
- End of 2026Refine the transition plan
- 2028Begin migrating critical systems
- 2029Google and Cloudflare: own post-quantum migration targeted
- End of 2030Complete the transitionNIST: quantum-vulnerable algorithms deprecated
- 2035NIST: quantum-vulnerable algorithms disallowed
Our commitments
How we work with you.
Six commitments apply to every engagement, and each is written into the statement of work.
Expert-led
A senior post-quantum cryptography expert leads every engagement from scoping to sign-off and remains the point of contact throughout.
Specialists named in advance
Each member of our Australian specialist bench is named in the statement of work before work begins.
Established method and tooling
A standardised assessment method and enterprise-scale discovery tooling, applied consistently at every scope.
Coverage stated plainly
Every inventory carries a coverage and confidence statement, including anything that could not be examined.
Data under client control, in Australia
Discovery runs on systems the client controls and records metadata only. Private keys and credentials are never collected. On-premise delivery is available.
Material returned or destroyed
At close, all engagement material is returned or destroyed, with written confirmation.
Independent advice. We recommend the tools and platforms best suited to each environment, including those already licensed, and document every choice with its rationale so teams can maintain it after the engagement.
Why now
Two quantum risks, and both begin today.
Harvest now, decrypt later (HNDL) threatens confidentiality: encrypted data captured today can be read once a cryptographically relevant quantum computer (CRQC) exists. Trust now, forge later (TNFL) threatens integrity: signatures, certificates and firmware trusted today could be forged.
Long-lived data and long-lived trust anchors are both exposed now, and post-quantum cryptography protects each from the point it is adopted.
Harvest now, decrypt later (HNDL) · Confidentiality
- Encrypted data captured today
- Stored for years
- Decrypted once a CRQC exists
Trust now, forge later (TNFL) · Integrity
- Signatures, certificates and firmware trusted today
- Signing keys derived by a CRQC
- Forged code, certificates and firmware accepted
Post-quantum cryptography · ML-KEM and ML-DSA
- Key establishment and signatures designed to resist a CRQC
Who we work with
Where confidentiality must outlast the decade.
Financial services
Banks, insurers and superannuation funds hold long-lived customer data, and much of their cryptography is operated by service providers. Supplier evidence sits within every plan we deliver.
Critical infrastructure
Energy, water, telecommunications, transport and health operators run systems that are slow to change. We establish where cryptography sits in operational technology and which systems will take longest to move.
Government
Commonwealth and state agencies hold information that must remain protected for decades. Our deliverables give executives and auditors a plan they can follow and evidence they can verify.
Begin with a 30-minute consultation.
A structured, expert-led conversation about your systems, data and obligations, designed for the CISO, chief risk officer or executive accountable for cryptographic risk. You leave with your likely exposure, the milestones that apply and a proportionate first step.
Book a 30-minute consultation