If you're responsible for enterprise security, the Möbius Bridge just moved "post-quantum migration" from your three-year roadmap to your quarterly objectives. Here's what matters.

Immediate Concerns

Data Already Captured

The most urgent concern isn't future traffic — it's data that has already been captured. Nation-state adversaries have been running "harvest now, decrypt later" programs for years, capturing encrypted traffic from high-value targets. If your organization has been targeted, that captured traffic may now be decryptable.

Action: Assess what data could have been captured in transit over the past 5-10 years. If it includes trade secrets, M&A plans, or classified information, those are now potentially exposed.

Compliance Implications

  • GDPR: If AES-encrypted personal data is now considered inadequately protected, breach notification obligations may apply to previously-encrypted data stores
  • HIPAA: Healthcare organizations using AES for PHI encryption may need to demonstrate migration plans
  • PCI-DSS: Card data encryption requirements reference approved algorithms — AES status may change
  • SOC 2: Encryption controls in trust service criteria will need updating

Cloud Infrastructure

All major cloud providers (AWS, Azure, GCP) use AES for:

  • Storage encryption (S3, Blob Storage, GCS)
  • Database encryption (RDS, Cosmos DB, Cloud SQL)
  • Key management (KMS, Key Vault, Cloud KMS)
  • Network encryption (VPC peering, VPN gateways)

Cloud providers will migrate, but your data is encrypted with their keys. You need to understand:

  • When your provider plans to migrate
  • Whether re-encryption of existing data is required (it likely is)
  • Whether customer-managed keys need rotation to new algorithms

The Migration Plan

Phase 1: Triage (Weeks 1-2)

  • Inventory all systems using AES
  • Classify by data sensitivity and exposure risk
  • Identify systems already supporting ChaCha20 or post-quantum algorithms
  • Assess which legacy systems cannot be easily upgraded

Phase 2: Quick Wins (Weeks 3-8)

  • Switch TLS configurations to prefer ChaCha20-Poly1305 where supported
  • Deploy post-quantum key exchange on external-facing services
  • Rotate credentials and API keys that were exchanged over AES-encrypted channels
  • Enable hardware 2FA for all privileged accounts

Phase 3: Systematic Migration (Months 3-12)

  • Re-encrypt data stores with non-AES algorithms
  • Update VPN infrastructure to WireGuard/ChaCha20
  • Migrate internal PKI to post-quantum certificates
  • Update compliance documentation and audit controls

Phase 4: Verification (Ongoing)

  • Penetration testing against new configurations
  • Continuous monitoring for AES usage in shadow IT
  • Vendor questionnaires for third-party risk assessment
  • Regular review of NIST and industry migration guidance

Budget Reality

This is not a small project. Enterprise-wide cryptographic migration touches:

  • Every database, every storage system, every API
  • Network infrastructure (VPNs, TLS terminators, load balancers)
  • Application code (hardcoded cipher suites, encryption libraries)
  • Third-party integrations and vendor contracts
  • Compliance auditing and re-certification

Plan for 0.5-2% of IT budget, depending on your infrastructure complexity and data sensitivity.

Start with assessment: Take the organizational risk assessment to identify your highest-priority gaps.