Quantum‑resistant encryption refers to cryptographic algorithms and architectures that are designed to remain secure even when attackers have access to powerful quantum computers. In the context of data in motion, it focuses on protecting information as it travels across public and private networks so that it cannot be decrypted in the future by quantum‑enabled adversaries. From the Thales Security Sessions content and related resources, there are a few key reasons to start planning now: 1. **Data has a long life, attacks can be “harvest now, decrypt later.”** Sensitive data that you transmit today (financial records, personal data, intellectual property, government information) may need to stay confidential for many years. Adversaries can capture encrypted traffic now and wait until quantum capabilities mature to decrypt it. That means your current network encryption decisions have long‑term impact. 2. **Post‑quantum readiness takes time.** The material emphasizes that although post‑quantum is projected to be a few years away, enterprises should start planning today to be post‑quantum ready. Updating crypto policies, inventorying where encryption is used, testing quantum‑resistant options, and aligning with vendors and partners are multi‑year efforts. 3. **Network security is broad and complex.** Network security covers tools, policies, and techniques to monitor, prevent, and respond to unauthorized access. In the Thales/Senetas podcast with Dr. Eric Cole and Julian Fay, the focus is on data in motion and the findings from a global survey on encryption of public and private networks. Those findings highlight that organizations often have gaps in how consistently they encrypt traffic, especially across hybrid and multi‑cloud environments. 4. **Risk management and HSMs are part of the strategy.** Security architects are increasingly using integrated Hardware Security Modules (HSMs) as part of broader information risk management strategies. HSMs help protect keys and enforce crypto policies, which will be important when you start to introduce quantum‑resistant algorithms into your environment. 5. **Practical next steps are available.** The content points to a free post‑quantum risk assessment to understand whether your organization is at risk of a post‑quantum breach. Combined with resources like the Thales Data Threat Reports and white papers on weaknesses in data in motion, this gives you a structured way to: - Assess which data needs long‑term protection - Identify where encryption is used (and where it is missing) - Prioritize migration paths to quantum‑resistant approaches In short, quantum‑resistant encryption is about future‑proofing your data in motion. Planning now helps you avoid rushed, reactive changes later and reduces the risk that today’s encrypted traffic becomes tomorrow’s exposed data.

The material highlights several shifts in cloud and API security that are relevant for any organization moving deeper into multi‑cloud and hybrid environments. **1. Cloud adoption has accelerated significantly.** Multiple Thales studies and podcast episodes point out that: - The COVID‑19 pandemic accelerated cloud adoption by about **three years** compared to pre‑pandemic expectations (citing McKinsey). - Gartner estimates that spending on public cloud services will exceed **$480 billion** in the near term. This rapid move to cloud, including multi‑cloud and hybrid deployments, has stretched traditional security models and identity and access management (IAM) infrastructures. **2. Identity and access are under pressure.** The 2021 Thales Access Management Index and related episodes describe how: - Remote access has become the norm, not the exception. - Many organizations no longer have a clear network perimeter. As a result, there is a need to rethink access management, including: - Strong authentication and modern access management (beyond just passwords) - Cloud single sign‑on (SSO) - Customer Identity and Access Management (CIAM) to improve user experience while maintaining compliance **3. APIs are now a primary security focus.** The **2025 KuppingerCole Leadership Compass: API Security Management** report, referenced in the text, highlights: - The importance of API discovery and runtime protection - The changing API security landscape, including trends like **AI‑driven threats** and **zero‑trust models** For organizations, this means: - You need visibility into all APIs (including “shadow” APIs) - Runtime protection and behavior monitoring are becoming as important as design‑time security - Zero‑trust principles (never trust, always verify) are increasingly applied at the API layer **4. Data security platforms and fine‑grained authorization are converging.** The **Gartner Market Guide for Data Security Platforms** (2025) emphasizes that combining data security controls with fine‑grained authorization leads to more efficient data security. In practice, this means: - Centralizing data protection policies across clouds - Applying granular access controls based on identity, context, and data sensitivity **5. Compliance and digital sovereignty are reshaping architectures.** The content notes that there are now **more than 1,800 data compliance laws** globally. This is driving: - Containment and localization of data - A rise in **data sovereignty**, **operational sovereignty**, and **software sovereignty** as foundations for broader **digital sovereignty** In the digital sovereignty episode, experts from Google Cloud and Thales discuss how governments and organizations are rethinking their dependence on foreign cloud infrastructure and looking for ways to ensure: - Data is stored and processed in specific jurisdictions - Operations and administration can be controlled locally - Software stacks can be governed in line with local regulations **6. Practical implications for your organization.** As you move more workloads and identities into multi‑cloud environments, you should: - Map where your data is stored and processed (the 2021 Data Threat Report found only **24%** of companies have complete knowledge of where their data is stored). - Strengthen IAM and CIAM, including cloud SSO and strong authentication. - Implement API discovery and runtime protection, and align with zero‑trust principles. - Consider data security platforms that unify encryption, key management, and fine‑grained authorization. - Factor in data sovereignty and local regulations as part of your cloud strategy. Thales and its partners position their technologies and reports as tools to help organizations secure this evolving landscape while supporting digital transformation.

The content brings together several related themes: data protection, compliance, and software licensing/entitlement management. Taken together, they point to a more integrated approach that considers people, processes, and technology. Here are practical steps based on the material: **1. Build a comprehensive data security strategy.** Thales emphasizes that organizations rely on its solutions to protect sensitive data and software wherever it is created, shared, or stored—on‑premises, in the cloud, and across multi‑cloud environments. To mirror this approach, you should: - Classify your data and identify what is most sensitive. - Use encryption and strong access controls for data at rest, in motion, and in use. - Consider Hardware Security Modules (HSMs) as part of an integrated risk management strategy to protect cryptographic keys and enforce policies. **2. Address regulatory and industry‑specific requirements.** The text lists multiple regulatory and guidance documents, such as: - New York State Cybersecurity Requirements for Financial Services Companies - Hong Kong cloud and backup security guidelines - India’s framework for adoption of cloud services by SEBI - Korea’s Personal Information and Information Security Management System (ISMS‑P) It also notes that there are now **more than 1,800 data compliance laws** globally, and that many include **data breach notification** requirements with a “safe harbor” clause when data is properly encrypted. To respond effectively: - Map applicable regulations by geography and sector. - Use encryption and key management to qualify for safe harbor where possible. - Align your cloud and data architectures with local data sovereignty and localization rules. **3. Use threat and trend reports to guide priorities.** Several reports are highlighted: - **2026 Thales Data Threat Report** – global data security trends and emerging tech risks. - **2025 Thales Data Threat Report – Financial Services Edition** – specific to financial services. - **2021 Thales Cloud Security Study** – based on a survey of more than **2,600 security professionals** worldwide. These reports provide: - Benchmarks on where other organizations are struggling (e.g., only **24%** know where all their data is stored). - Insight into emerging risks (e.g., multi‑cloud complexity, remote work, AI‑driven threats). You can use these findings to: - Prioritize investments (e.g., data discovery, cloud key management, access management). - Justify budget and roadmap decisions to leadership. **4. Get software licensing and entitlement management right early.** The content references: - “How to Get Software Licensing Right the First Time” – a practical guide that stresses people, processes, and technology. - A **Software Licensing & Entitlement Management Buyer’s Guide** – with criteria, evaluation questions, and best practices. Key takeaways for your organization: - Treat licensing and entitlement as part of your security and business strategy, not just a legal or operational task. - Choose platforms that support scale, security, and growth—especially if you deliver software or services to customers. - Ensure licensing controls align with your data protection policies (for example, how license data is stored, how customer identities are managed, and how access is revoked). **5. Leverage partner ecosystems and expert communities.** The Thales Partner Ecosystem and the Thales Accelerate Partner Network are designed to help partners and customers: - Access specialized skills and expertise. - Implement and integrate Thales technologies more effectively. In addition, the podcast series brings in experts across payments, fintech, regtech, cybercrime, and cloud security. This underlines the value of: - Engaging with external experts and advisors. - Learning from cross‑industry best practices (e.g., financial services, payments, and cloud‑native organizations). **6. Combine technology with people and process improvements.** Across the podcasts and resources, there is a consistent message: effective security and compliance are not just about tools. They require: - Training and awareness (for security teams, developers, and business stakeholders). - Clear processes for data mapping, incident response, and vendor management. - Governance that connects data protection, compliance, and software licensing decisions. By approaching data protection, compliance, and licensing as a connected set of capabilities—supported by encryption, access management, data discovery, and well‑designed licensing platforms—you can reduce risk, meet regulatory expectations, and support sustainable digital growth.