Mapping Your Encryption Alone Won’t Make Your Organization Quantum Ready

Horizen Labs has partnered with Venari Security so organizations can move from knowing what cryptography they run to knowing what to do about it. Venari finds and tracks the cryptography across an organization's systems. Horizen Labs turns those findings into prioritized, board-level risk decisions through our Quantum Threat Assessment. With harvest now, decrypt later attacks already underway, that second step can't wait.

In a recent conversation, Horizen Labs CEO Rob Viglione and Venari Security CEO Tom Millar explained why the two companies are working together, and what each brings.

Why now: weak cryptography is already being exploited

Quantum risk is a business risk today because two threats are already in motion. Adversaries are collecting encrypted data now to decrypt once quantum computers are capable enough. And AI is helping attackers find weak cryptography faster than most security teams can track it.

Rob's point was that the exposure doesn't wait for quantum computers. Weak cryptography is already being broken through deprecated protocols, expired certificates, and hard-coded keys. Data with a long confidentiality life, such as health records, financial data, and intellectual property, carries the most risk.

The good news, Rob noted, is that there are now standards to plan around. NIST published its first quantum-resistant cryptography standards, FIPS 203, 204, and 205, in August 2024. The UK's National Cyber Security Centre has set migration milestones of 2028, 2031, and 2035, and mandates in the US and the EU are following.

Most organizations don't know what cryptography they run

When organizations first look at their cryptography, they usually find no real inventory. Cryptography is buried across applications, network traffic, third parties, and legacy systems, and ownership of it is often unclear, even at the most advanced companies.

Tom shared an example from one of Europe's most advanced banks. In its private banking and wealth management division, Venari found TLS 1.1 still running, along with a null cipher misconfiguration that left traffic effectively unencrypted. These were, as Tom put it, "really quite serious issues that go unnoticed."

Venari addresses this by continuously monitoring encrypted network traffic, without ever decrypting it. The output is a cryptographic bill of materials (CBOM), which becomes the foundation of a cryptographic system of record: a single source of truth for every key, cipher, protocol, and owner.

A scan tells you what you have, not what to do

Cryptographic discovery is the first step in any quantum readiness program, but discovery on its own produces data, not decisions. A CBOM can list every algorithm, key, and certificate in your estate. It cannot tell leadership which of those exposures matter most.

Rob put it plainly in the conversation. A scan, he said, gives you "a very sophisticated and very long list" of your cryptographic posture. "And that doesn't tell your board what to do."

That matters because the decisions about quantum risk sit with management and the board. They have to decide what to fix first, what to fund, and what level of risk the organization will carry in the meantime. A long technical inventory doesn't answer any of those questions on its own.

Visibility from Venari, judgment from Horizen Labs

The partnership splits the work along what each company does best. Venari provides the cryptographic visibility. Horizen Labs provides the analysis that turns it into a ranked, business-level view of risk that leadership can act on.

Venari's platform covers discovery from the outside in, starting with an external snapshot of what an organization exposes and extending to internal discovery. As Tom explained, many organizations "have no understanding of what's accessible from the outside or the inside." Venari's data closes that gap and gives Horizen Labs an accurate picture to work from.

Horizen Labs then brings what Rob described as the market intelligence and business intelligence to interpret that picture. Our cryptographers rank and prioritize the findings and build them into our Quantum Threat Assessment, a human-led, fixed-fee assessment designed to give management and boards a clear view of where their exposure actually is. In Tom's words, Venari's data feeds the organization's cryptographic system of record and enriches the assessment.

The credibility behind that analysis comes from practice. Horizen Labs has spent close to a decade building and operating production cryptographic systems at scale in adversarial environments.

Rob was also clear about how the partnership fits our approach: "we try to stay vendor neutral." Horizen Labs works with partners whose tools we trust, Venari among them, but the assessment's job stays the same: telling clients what matters most to their business.

Governing it: one continuous loop, one set of controls

Boards need more than a one-off inventory. They need proof of progress. That takes a continuous governance process, ideally one that covers quantum and AI risk together rather than as separate programs.

Tom described Venari's approach in four stages:

1. Aggregation: getting the signal into the system.
2. Transformation: turning that data into intelligence, such as a CBOM and a list of priorities.
3. Prioritization: weighing each change's blast radius, meaning its knock-on effects across the rest of the environment.
4. Gating: the continuous loop - reassessing the environment, removing weak cryptography when it appears, and proving it doesn't return. That loop is what crypto-agility looks like in practice.

Rob connected this to AI governance. AI systems already depend on cryptography for model protection, data pipelines, and machine identities, and AI is accelerating the quantum timeline. His recommendation is "one set of controls and reporting to cover both."

Where to start this quarter

Good remediation starts by prioritizing business risk and data shelf life, not algorithms. Rob's advice is to catalog the long-lived, sensitive data in your systems first, because that is where harvest now, decrypt later does its damage.

From there, build crypto-agility so algorithms can be swapped as needed. Some algorithms will be broken outright once quantum computers are powerful enough, and others will only be weakened, so security becomes an ongoing cat-and-mouse game. Meanwhile, take the quick wins. Retiring weak protocols now also cuts the AI-driven attack exposure organizations already face.

Asked for one thing a CISO should do this quarter, the two CEOs gave complementary answers. Tom's was to find out what cryptography is really running and put a cryptographic system of record in place, because "you can't defend what you can't see." Rob's was to identify which data must remain confidential beyond 2030, because any data that must stay protected past that line is at risk now.

What this means for your organization

The hardest part of quantum readiness is not finding your cryptography but deciding what to do about it. That decision belongs to leadership, and leadership needs a ranked view of business risk rather than a technical list.

That's the gap this partnership is built to close. Venari makes sure nothing is missed. Horizen Labs makes sure what's found becomes a decision the board can make with confidence. Organizations that treat discovery as the finish line will end up with a better-documented problem. Those that treat it as the starting point for prioritization will end up with a plan.

Watch the full conversation between Rob Viglione and Tom Millar:

Read the partnership announcement from Venari Security: Venari partners with Horizen Labs

About Venari Security

Venari Security's adaptive Cryptographic Intelligence Platform combines advanced AI, cryptographic discovery, and continuous assurance to help enterprises manage encrypted estates with confidence.

By turning hidden cryptographic data into meaningful business intelligence, Venari enables leaders to see risk clearly, act decisively, and move toward a quantum-safe future – without disrupting today’s operations.