Marin Ivezic

Founder, AppliedQuantum.com (and SecureQuantum.com) | Former CISO, CTO, Big 4 Partner, Quantum & Cyber Entrepreneur | #Quantum, #QuantumComputing, #QuantumSecurity #QuantumResistance #PQC #QuantumAI #QuantumML #Cybersecurity #QuantumReadiness #Q-Day

Company: https://appliedquantum.com
Company: https://securequantum.com
Blog: https://postquantum.com
Twitter: https://twitter.com/infosec
Telegram: https://t.me/infosec

Last Notes

2026-08-14 18:48:08 CEST

With the new hack-back memo, the US has shot itself in the foot again. And most of the initial online discussions miss how far the damage reaches. For the US.
Quick summary. On August 12 the President signed a memorandum letting vetted American companies break into foreign systems used by criminal groups and disrupt or destroy them. It is not vigilantism: the companies act under federal direction, and two officials approve every operation in writing.
Americans lost more than $20 billion to this fraud last year, so the motivation is real. I am not against acting. I am against this approach, and I know the arguments because I spent years making them to governments that wanted the same thing.
The debate so far has been about whether private firms should do this, and whether innocent foreigners get hurt. However I analyze it, the first casualty is American:
- Why would anyone share threat intel with Americans, when it could now be used to attack infrastructure in their own country?
- Why would a non-US CISO keep American EDR and XDR agents deep in their stack, when nobody can tell them whether that vendor also runs surveillance and offensive operations for the state?
- Why would anyone outside the US let an American vendor build the map of their weakest cryptography, in the PQC discovery and inventory work their own regulator is forcing them to do?
- Why would a European buyer accept "we cannot comment" as a tender answer?
- Why would an American firm disclose the flaw it just found, when its other contract values that flaw unpatched?
- Why would a sovereign wealth fund hold a listed US security vendor it has no way to assess?
- Why would an allied service share access with a partner whose contractors may be on the same box?
- How does a US prosecutor explain the next indictment of a Chinese contractor hacker?
- What does Washington say when Beijing runs the same program and calls it law enforcement?
Procedures are due October 11 and need not be published. Which means these questions may never get a public answer, and every one of them will get answered by assumption instead. None of those assumptions will favor the American cybersecurity industry.
https://postquantum.com/cyber-kinetic-security/cyber-privateers-what-breaks/
#Cybersecurity #CISO #CyberPolicy #ThreatIntel #NationalSecurity #InfoSec #VendorRisk #PQC

2026-07-19 17:25:13 CEST

- reply

Fair question, and you're right that Internet-facing OT and medical devices have more urgent problems than PQC. Fixing basic exposure is a prerequisite to worrying about PQC.
But measuring PQC readiness by device type is how you find out which vendors and device categories will be the last-mile problem when regulatory deadlines (CNSA 2.0 2030, NIST deprecation 2030, UK NCSC 2028/2031/2035) become an issue.

2026-07-18 20:49:00 CEST

Internet-wide PQC measurement: 160M SSH hosts scanned.
IT: 12% PQC-capable. OT: under 5%. Medical devices: under 5%. Cloud leads because providers deploy PQC by default. Everything else waits for manual upgrades nobody has scheduled.
The OT gap should alarm anyone in ICS/SCADA.
https://postquantum.com/security-pqc/forescout-pqc-adoption-data-2026/
#PQC #OTsecurity #ICS #infosec

2026-07-15 19:29:05 CEST

After the White House quantum summit, I tested the claim that America built "every layer of the quantum stack." Eight layers. Named researchers. Primary sources.
Quick scorecard:
The PQC algorithms (ML-KEM, ML-DSA, SLH-DSA) that NIST standardized and that EO 14412 mandates for federal systems? Designed almost entirely by Europeans and Canadians. CWI (Netherlands), Bochum (Germany), IBM Zurich (Switzerland), ENS Lyon (France), Waterloo (Canada). NIST ran the process — that's a real institutional win. But the algorithmic content is international.
The enabling infrastructure is even more striking.
Dilution refrigerators from Finland (Bluefors) and UK (Oxford Instruments) dominate the market that cools US superconducting quantum computers. Domestic manufacturing exists (Maybell in Denver, Bluefors's Syracuse operation) but the US remains substantially dependent on European-headquartered suppliers.
Control electronics from Switzerland (Zurich Instruments), Israel (Quantum Machines), Germany (Rohde & Schwarz).
The CHIPS Act quantum investments are partly a response to these dependencies.
On the science side: Josephson junction predicted at Cambridge (1962). First superconducting qubit demonstrated at NEC Japan (1999). Surface code traces to Kitaev (Russia). Steane code from Oxford. qLDPC codes from French and Russian mathematicians.
The US built the strongest commercial integration and scaling layer. That is a real and hard-won capability. It is not the same as sole authorship of the entire stack.
Policy implication: "we built everything" leads to different supply chain decisions than "we built the best integration layer, and it depends on allied supply chains." The second framing is more accurate and produces better policy.
Full article with every claim sourced:
https://postquantum.com/quantum-sovereignty/who-built-the-quantum-stack/
#quantum #PQC #infosec #cryptography #postquantum #supplysecurity #quantumcomputing #cybersecurity