IBM has launched IBM Quantum Safe, a suite that frames the migration to post-quantum cryptography as a series of waves of work under continuous governance. We see the right model, though crypto agility is built in the organization, and containment and internal PKI remain the harder work.
What Is Covered in This Article:
- IBM Quantum Safe brings strategy, discovery, assessment, remediation, and governance together into a single suite of three offerings.
- Crypto agility is an organizational capability, and survey data suggests buyers still treat the migration as a project.
- Prioritization should follow the length of time data must remain secret, starting with asymmetric cryptography.
- Discovery never finishes, so containment and bridging for systems that will not migrate matter less than inventory.
- IBM’s migration of its own products, and CBOM disclosure for them, may matter to customers as much as the suite itself.
The News: On October 27, 2026, IBM announced IBM Quantum Safe, a suite for planning and running post-quantum cryptography (PQC) migration that builds on Guardium Cryptography Manager, which IBM introduced in 2025. The suite has three parts: Quantum Safe Cryptography Manager, which discovers assets and cryptographic objects across IT operations and tracks migration progress and cryptographic posture; Quantum Safe Explorer, which scans source code for cryptography, vulnerabilities, and crypto-agility anti-patterns and generates cryptography bills of materials (CBOMs); and Quantum Safe Proxy, which handles traffic between legacy and post-quantum clients and servers.
IBM organizes the suite around five areas (strategy, discovery, assessment, remediation, and continuous governance) that it says organizations work through iteratively and in parallel, starting from goals tied to critical business applications. IBM cites its researchers’ role in co-developing two of the first three NIST PQC standards, as well as lessons from its own internal migration.
IBM Quantum Safe Treats PQC Migration as More Than Just a Project
Analyst Take: Post-quantum announcements tend to arrive framed around a deadline, and much of what the market sells under that banner is, at its core, discovery: find the cryptography, score it, report on it. IBM’s announcement is more interesting for how it describes the work than for any single capability, since the company frames PQC migration as proceeding in waves shaped by risk, dependencies, and business demand, worked on iteratively and in parallel, and governed “throughout the journey and beyond.”
We feel that is the right model. In our view, migration is a permanent operating condition rather than a project with an end date: classical and post-quantum cryptography will run side by side for a period nobody can date, and some of the estate will never move at all. IBM deserves credit for saying so in its own launch material, and for naming crypto agility as the end state, though that last point is also where we would push a little further.
Crypto Agility Is Built into the Organization
Crypto agility is increasingly marketed as something a product has, typically meaning it can switch algorithms as standards evolve. That is a useful property, but it is not the capability organizations need. To us, crypto agility is organizational: can teams recognize cryptography when they meet it in a code review or a vendor assessment, do they know who owns a cryptographic decision, does change management treat a certificate migration as more than a patch, and can engineering ship a cryptographic change in a critical system without a multi-month project?
A suite such as Quantum Safe helps with the first two of those, finding cryptography and coordinating tasks across “teams, systems and owners,” in IBM’s words. It cannot supply execution capacity, or the procurement and build standards that stop new classical dependencies from arriving every quarter. The parallel we would draw is with cloud and digital transformation a decade ago, when cloud was the instrument and the transformation happened (or did not) inside the organization.
Our data suggests buyers are still in project mode. In the Futurum 1H 2026 Cybersecurity Decision-Makers Survey, 35% of data security respondents (N=104) placed auditing and upgrading enterprise encryption to PQC standards among their top three initiatives, while only 20% placed managing crypto agility among their top three challenges. Boards fund projects, and this is a practice, so helping customers make that case internally may do as much for adoption as any dashboard.
Start From How Long the Data Must Stay Secret
IBM’s strategy-first approach, which starts from critical business applications before descending into discovery, is a welcome correction to the inventory-first habit that has left many programs with long lists of findings and no clear place to start. We would refine the starting point, though. Business criticality and confidentiality longevity are different questions, and harvest-now, decrypt-later exposure follows how long data must stay confidential, so a modest system holding records that must stay secret for 20 years may matter more here than a revenue-critical application handling short-lived data.
Within that, asymmetric cryptography (RSA, elliptic-curve, and Diffie-Hellman) comes first because a capable quantum computer can eventually break it outright, while symmetric ciphers such as AES-256 hold up reasonably well.
There is also a compliance risk worth naming. For most organizations, mandates will arrive before the threat does, and regulators can audit inventories, plans, and attestations far more easily than reduced exposure. Continuous governance that tracks “policy-driven compliance” is useful, but buyers should ask how the suite would demonstrate that exposure has decreased, not merely that an audit would pass. Ideally, that risk context would draw on the enterprise risk data teams already maintain, rather than add another score.
Containment Matters as Much as Discovery
The cryptographic inventory will never be complete. There is no CVE-equivalent for cryptography; commercial software and firmware hide their internals, and shadow PKI accumulates faster than audits can find it. IBM’s own client-zero work, published in 2025, is the right kind of evidence here: its CIO Office used Quantum Safe Explorer to scan roughly 5,800 repositories and 47 million lines of code, surfacing more than 3,900 issues that needed quantum-safe remediation.
That is also the most tractable layer of the estate, where source code is available and cryptography bills of materials, which we consider necessary but troubled, work best. The harder exposure sits in what organizations buy rather than build.
This is why we see Quantum Safe Proxy as more than a footnote. Handling legacy and post-quantum clients side by side is containment and bridging for systems that will not migrate soon, or ever, and that is where many programs are thinnest. A bridge is not a destination, though, and internal PKI, which lacks the forcing function browsers provide on the public web, will still need deliberate work. Buyers should ask which algorithms, parameter sets, hybrid or pure modes, and validated modules ship today versus on the roadmap.
IBM Is a Supplier as Well as a Toolmaker
The pace of this migration is set largely upstream of the enterprise, by libraries, platforms, and the vendors whose software customers run but cannot see inside. IBM sits on both sides of that line. Its announcement cites lessons from migrating its own products and services, and, for its installed base, that work (and the accompanying CBOM disclosure) may matter as much as the suite itself.
The field is crowded and approaching from several directions, including machine identity and PKI specialists such as Keyfactor, DigiCert, Entrust, and CyberArk (now part of Palo Alto Networks), PQC-focused firms such as SandboxAQ and QuSecure, and platforms building post-quantum capabilities into existing offerings, such as Palo Alto Networks and Cloudflare, among others. Many now describe a similar journey from strategy to governance.
As basic discovery becomes a feature, we reckon differentiation moves to orchestration, services, and evidence. IBM’s stronger case rests on breadth, from the research behind two of the first NIST standards to its consulting arm and its own estate, rather than on the five-step method itself.
What to Watch:
- Will IBM publish CBOMs for its own software? For customers running IBM products, disclosure of what cryptography those products use, and when it changes, would be the most direct benefit of IBM’s own migration.
- Can the governance layer show reduced exposure, not just compliance? Measuring migrated channels against long-lived data, rather than counting inventories and attestations, is what separates progress from audit-ready paperwork.
- What ships in Quantum Safe Proxy, and in which configurations? Algorithms, hybrid or pure modes, and validated modules matter more as national guidance diverges on whether hybrid is required.
- How far does the suite reach into internal PKI? Composite certificates, parallel certificate chains, and shadow PKI are where enterprise migrations tend to stall, with no browser-style deadline pushing them along.
- Do IBM Consulting and its partners turn this into a recurring service? Running classical and post-quantum cryptography side by side is ongoing work, which suits a managed service better than a one-time readiness assessment.
For more information, read the full announcement from IBM.
Declaration of generative AI and AI-assisted technologies in the writing process: This content has been generated with the support of artificial intelligence technologies. Due to the fast pace of content creation and the continuous evolution of data and information, The Futurum Group and its analysts strive to ensure the accuracy and factual integrity of the information presented. However, the opinions and interpretations expressed in this content reflect those of the individual author/analyst. The Futurum Group makes no guarantees regarding the completeness, accuracy, or reliability of any information contained herein. Readers are encouraged to verify facts independently and consult relevant sources for further clarification.
Disclosure: Futurum is a research and advisory firm that engages or has engaged in research, analysis, and advisory services with many technology companies, including those mentioned in this article. The author does not hold any equity positions with any company mentioned in this article.
Analysis and opinions expressed herein are specific to the analyst individually and data and other information that might have been provided for validation, not those of Futurum as a whole.
Read the full Futurum Group Disclosure.
Other Insights From Futurum:
IBM Q3 FY 2026: Software Growth and Deal Recovery Lift Execution
Where AI Delivers Real ROI: AI-First Integration and Orchestration
Anderon Finalizes $1 Billion CHIPS Award. Who Buys Quantum Wafers Besides IBM?
Author Information
Fernando Montenegro serves as the Vice President & Practice Lead for Cybersecurity & Resilience at The Futurum Group. In this role, he leads the development and execution of the Cybersecurity research agenda, working closely with the team to drive the practice's growth. His research focuses on addressing critical topics in modern cybersecurity. These include the multifaceted role of AI in cybersecurity, strategies for managing an ever-expanding attack surface, and the evolution of cybersecurity architectures toward more platform-oriented solutions.
Before joining The Futurum Group, Fernando held senior industry analyst roles at Omdia, S&P Global, and 451 Research. His career also includes diverse roles in customer support, security, IT operations, professional services, and sales engineering. He has worked with pioneering Internet Service Providers, established security vendors, and startups across North and South America.
Fernando holds a Bachelor’s degree in Computer Science from Universidade Federal do Rio Grande do Sul in Brazil and various industry certifications. Although he is originally from Brazil, he has been based in Toronto, Canada, for many years.
