Black Kite adds quantum readiness to supplier cyber ratings

Black Kite has launched Quantum Readiness for third-party cyber risk management, adding new controls to the SSL/TLS Strength category in its cyber rating system.

The product is designed to assess quantum agility across an organisation's supplier base and show which vendors are using, or moving towards, quantum-safe encryption methods.

The release is intended to address a gap in how companies assess supplier security as concerns grow over the eventual impact of quantum computing on current encryption standards. Organisations send sensitive data through third parties every day but often have limited visibility into whether those vendors are preparing for a post-quantum environment.

The controls examine observable signs of post-quantum cryptographic readiness, including hybrid post-quantum key exchange, certificate signature readiness and assets without an identified migration path. Rather than being issued as a standalone score, they have been added to the existing Black Kite Cyber Rating framework.

Regulatory pressure

The launch comes as regulatory timetables for post-quantum cryptography become clearer in the United States and Europe. Black Kite pointed to the US National Institute of Standards and Technology schedule, which deprecates RSA, ECDSA and ECDH after 2030 and disallows them after 2035.

It also cited OMB M-26-15, which sets deadlines for US agencies to move to post-quantum key establishment by the end of 2030 and digital signatures by 2031. Executive Order 14412 has also begun the process for a federal acquisition rule requiring covered contractors to meet NIST post-quantum standards by the end of 2030.

In the European Union, member states are expected to have national plans and cryptographic inventories in place by the end of 2026, while high-risk critical infrastructure is due to migrate by 2030. NIS2 already places supply chain security and cryptography within current risk management obligations.

This, Black Kite said, means companies will need better visibility into the cryptographic posture of both their own systems and the third parties they rely on.

"Third-party cyber risk management needs to account for where risk is going, not only where it exists today," said Ferhat Dikbiyik, Chief Research & Intelligence Officer at Black Kite. "We built Quantum Readiness to give customers early visibility into quantum agility across their supply chains and help them understand which vendors are preparing for one of the most significant cryptographic transitions ahead."

Long transition

The issue has drawn attention because of concern over so-called harvest-now, decrypt-later attacks, in which encrypted data is collected in advance and stored until more powerful quantum systems can break current protections. While quantum computers capable of defeating today's encryption do not yet exist, some experts have suggested that point could arrive within the next few years.

That has implications for sectors that handle sensitive information with a long useful life, as data intercepted now may still be valuable when decryption methods improve.

According to Black Kite, the new controls allow customers to evaluate supplier quantum agility across their vendor ecosystem, identify vendors that are ready or moving towards readiness, monitor progress over time and prepare for emerging regulatory requirements.

The company is also targeting public sector users and organisations with federal supply chain exposure. It said agencies and contractors will need a clearer view of whether partners across broader supplier networks are taking steps towards post-quantum cryptography.

"Quantum readiness cannot stop at the agency perimeter," said Megan Rolander, Public Sector Director at Black Kite. "Federal agencies depend on complex networks of contractors and technology providers, and they need to understand how prepared those organisations are for the transition to post-quantum cryptography. Black Kite gives agencies visibility into quantum agility across that broader ecosystem before these requirements become more urgent."

An external industry voice also backed the need for early assessment of supplier preparedness, as migration programmes are expected to take years.

"The uncertainty around Q-Day is exactly why organisations need to prepare now," said Konstantinos Karagiannis, Senior Director of Quantum Computing Services at Protiviti. "Cryptographic migrations take years, and sensitive information being transmitted today could remain valuable to attackers long into the future. Measuring quantum agility provides an important signal of how mature an organisation's security programme is and whether it is taking the steps necessary to prepare for the coming quantum era."