Every bank will have to swap out its encryption. I want to build the map that shows where to start. #security, #cryptography, #quantum, #cybersecurity

Saurrav Dasgupta — Sat, 14 Nov 2026 15:10:03 +0000

Ask a bank's CISO a simple question: where exactly does your organisation use RSA or elliptic-curve cryptography?

Most can't answer it precisely. It's in TLS configs, certificates, code-signing pipelines, VPNs, payment message flows, third-party libraries, and a long tail of legacy services nobody has touched in years.

That question just became urgent.

Why now: the quantum deadline is real

Today's public-key encryption (RSA, ECC) is expected to be breakable by sufficiently powerful quantum computers. Attackers don't have to wait for that day either. "Harvest now, decrypt later" means data stolen today can be decrypted later.

What changed in 2026 is that migration moved from research to compliance:

United States: Executive Order 14412 (22 June 2026) sets dated deadlines to move federal high-value systems to NIST's post-quantum standards: key establishment by end of 2030, digital signatures by end of 2031. It also reaches federal contractors.
India: the RBI set up an expert committee (Q-SAFE) in May 2026 to assess banks' quantum readiness and build a migration roadmap, and CERT-In has published guidance on quantum cyber readiness.
Standards exist: NIST finalised the first PQC standards (FIPS 203, 204, 205) in August 2024.

So the question isn't whether banks migrate. It's how fast, in what order, and how they prove it.

The algorithms are the small part. The migration is the big part.

The new algorithms are already standardised. What's hard is everything around them:

Discovery: finding every place vulnerable crypto lives.
Prioritisation: deciding what to migrate first (long-lived data, payment rails, customer-facing systems).
Planning: sequencing changes across hundreds of systems and vendors.
Proof: showing regulators and auditors what was changed and that it works.

This is a product, workflow and quality problem, not a physics problem. That's the kind of problem I've worked on for 12+ years across capital-markets trading platforms, FIX connectivity and large platform migrations.

The idea: an AI-assisted cryptographic inventory

A tool that:

Scans codebases, configuration files and certificates to find every use of quantum-vulnerable cryptography
Ranks the risk of each finding (data sensitivity, exposure, how long the data must stay secret)
Generates a migration plan with sequencing and dependencies
Produces test evidence that each change works, ready for audits and regulators

AI helps with the messy parts: spotting crypto use in unfamiliar code, explaining why something is risky in plain language, and drafting migration and test plans that humans then review.

The wedge

Established security vendors are already moving into PQC, so a broad "do everything" tool won't win. My starting point is narrower: Indian banks and NBFCs, as RBI and CERT-In expectations firm up. Many smaller institutions won't have the budget for large consulting engagements, but they'll still need to answer the regulator's question.

I'd love your input

If you work in banking security or PKI: what's the hardest part of finding where your crypto lives?
If you've done a crypto-agility or PQC pilot: what did your inventory process look like?
What would make a tool like this trustworthy enough to use in a regulated bank?

Comments and DMs are open. I'll share progress as this takes shape.