Advisories
Post‑Quantum Authentication: Immediate Steps for SecOps and PKI Teams
Microsoft’s Post‑Quantum Cryptography (PQC) TLS Pilot Program invites certificate authorities to test new algorithms in a controlled environment. Security teams should inventory certificate dependencies, review vendor roadmaps, and set up non‑production test beds to surface interoperability gaps before PQC becomes mandatory.
Microsoft’s Post‑Quantum Cryptography (PQC) TLS Pilot Program is now available to help certificate authorities test interoperability and operational readiness for post‑quantum authentication.
What Happened
The program invites eligible CAs to evaluate new PQC algorithms in a controlled environment, exposing potential gaps in certificate issuance, validation, and storage.
Impact
- All PKI components that rely on TLS certificates—CA services, HSMs, edge devices, and application servers—may need algorithm updates.
- Long‑lived certificates and legacy hardware could become incompatible with PQC signatures.
- Operational processes such as renewal, revocation, and key rollover may require redesign.
What to Do Now
- Inventory every system that issues, validates, or stores certificates.
- Review vendor roadmaps for PQC support and plan migration timelines.
- Set up a non‑production test bed that mirrors production PKI and run the pilot’s test cases.
- Document gaps and update procedures before PQC becomes mandatory.
Looking Ahead
Early testing will surface interoperability and process gaps, allowing defenders to address them before post‑quantum authentication is required at scale.
Related articles
Chrome Launches Merkle Tree Certificate Initiative to Enable Quantum‑Safe HTTPS
Google’s Chrome team has announced a new effort to adopt Merkle Tree Certificates (MTCs) for quantum‑resistant TLS. The initiative, driven by the IETF PLANTS working group, replaces bulky X.509 chains with compact proofs, allowing post‑quantum algorithms without bandwidth penalties. Defenders should monitor MTC deployment and update CT logs accordingly.
Read briefing
Choosing an Incident Response Retainer: Key Questions for SecOps Teams
SecOps and sysadmins must vet incident response retainers before signing. Focus on SLA clarity, scope, hidden costs, threat profile fit, and post‑incident support. This briefing outlines the essential questions to ask and actions to take.
Read briefing
macOS 27.2 Beta 3 Released – Immediate Testing Required for SecOps Teams
Apple has released macOS 27.2 beta 3 (build 26B5101f) to developers. The update brings new security enhancements and bug fixes, but also introduces untested changes that could affect existing controls. SecOps and sysadmins should deploy the beta in isolated environments, validate firewall and IDS signatures, and monitor for anomalous behavior before any production rollout.
Read briefing
MITRE ATT&CK Framework Adoption Drives Threat Intelligence Standardization
The MITRE ATT&CK® framework has become the industry standard for cataloguing adversary tactics and techniques, enabling defenders to map attacks more precisely. Security teams across sectors now use ATT&CK to structure threat intel, improve detection, and prioritize mitigations. This briefing outlines the practical steps for SecOps, sysadmins, and defenders to integrate ATT&CK into their operations.
Read briefing