Session: Post-quantum cryptography: the deadline already built into your AV kit

• Event: ISE 2026
• From session: Unlocking Tomorrow: Quantum threats and the future of security
• Speaker: Shaun Reardon, Head of Section - Industrial Systems Cyber Security, DNV Cyber
• Estimated read time: 8 minutes
• Watch the full session

Quick read summary

• Post-quantum cryptography is not a problem for the next decade: AV kit installed this year will still be running when quantum computers can read it.
• Shaun Reardon of DNV Cyber cited NCSC and NIST estimates that encryption-breaking quantum power is about five years away, most likely reached through the cloud.
• Attackers can copy firmware and encrypted streams today and wait, which turns a ten-year product life into a live risk.
• New algorithms already exist and can run alongside current encryption, so nobody needs a single switchover date.

Most of the AV industry still files quantum computing under science fiction, or under a problem for banks in the 2030s. Shaun Reardon of DNV Cyber spent his ISE 2026 session taking that comfort apart. His argument: post-quantum cryptography is a question for the products leaving the warehouse this year.

He made the wider case for AV security at ISE 2025, covered in 7 essential cybersecurity insights every pro AV professional should know. This year he put a clock on it.

Today’s secrets have a five-year shelf life

The encryption protecting AV products today could be opened by attackers within about five years. Reardon cited the latest estimates from the UK’s National Cyber Security Centre (NCSC) and the US National Institute of Standards and Technology (NIST).

Attackers will not need a quantum machine of their own. It will be on the cloud, he said, and criminal groups run cloud infrastructure just as the big technology companies do.

That moves the subject from the lab to the boardroom.

If quantum risk is a technical niche, it waits in an engineer’s backlog. If it is business risk, it sits beside competition, law and geopolitics.

Why does quantum computing break some encryption and not others?

Quantum computing threatens the key-pair methods used to exchange keys and sign software, while one-key methods are largely unaffected. Symmetric encryption uses one key to lock and unlock, and its weakness is getting that key to the recipient safely. Asymmetric encryption solves this with two related keys, a public one anyone can use to lock a message and a private one only the recipient holds.

Reardon showed estimates of 20 million to 2 billion years for a classical computer to break those keys. A qubit, unlike a classical bit, can be zero and one at once, and Reardon said 50 qubits gives about one quadrillion variations. With that power, breaking a public key drops to hours, days or weeks.

Where does AV equipment sit in the attack path?

AV equipment sits on the same IP networks as everything else, and on industrial sites it often bridges the corporate network and the systems that move machinery. People used to think "it’s just a screen, it’s just a speaker," Reardon said. Now all the AV protocols run over IP.

That matters most in operational technology, the systems that operate cranes and move robotic arms. In a control system, he warned, "if that robotic arm moves at the wrong time, somebody can get hurt or worse." A hacked desktop, by contrast, is an annoyance.

For control room integrators, his question was what happens if the sensor feed on those screens has been altered. ISE has also covered proactive control room defence.

A certificate is not a defence

A certificate does not make a system secure, Reardon argued, even though his employer is one of the world’s leading certification bodies. He named ISO 27001 for information security and IEC 62443 for industrial systems. A firm may not need the certificate, he said, but it should meet the standard as a minimum.

A certificate says nothing about whether control room firmware is signed with an algorithm that will survive the decade it is expected to run.

What is harvest now, decrypt later?

Harvest now, decrypt later means stealing encrypted data today and storing it until a quantum computer can read it. Reardon said there is evidence attackers are already collecting.

His example was firmware. He said he can easily extract it from devices today, though he cannot yet crack its protection. A product installed in a factory or theatre might stay in service for ten years. If its protection falls after five, attackers have had a copy waiting for half its working life.

That is why five years is not a grace period, and Reardon said it could take less.

How does post-quantum cryptography fit alongside today’s encryption?

Post-quantum cryptography can run in tandem with existing encryption, so a product gains protection without breaking compatibility.

Reardon named two of the new methods, CRYSTALS-Kyber and CRYSTALS-Dilithium. NIST standardised them in August 2024 as ML-KEM (FIPS 203) for key exchange and ML-DSA (FIPS 204) for signatures, among its first finalised post-quantum encryption standards. Being phased out are RSA, DSA, ECDSA, ECDH and Diffie-Hellman.

A manufacturer can add quantum-safe encryption to the way keys are delivered while the old methods keep working, then retire them once the estate has moved.

What is the year 2038 problem, and why does it hit AV firmware?

The year 2038 problem is a date overflow due on 19 January 2038 for Linux and Unix-based systems that store time as a signed 32-bit integer. Those systems count time from 1 January 1970, and when the integer runs out of room, Reardon said, affected devices will reset to 1901. Much AV firmware runs on those systems.

His advice was short. Ask the people who maintain your firmware whether it uses signed 32-bit time, and change it if it does.

The law now reaches the AV supply chain

Reardon listed GDPR, NIS2, the EU AI Act and the Cyber Resilience Act, which requires manufacturers of digital products and software to make them secure. NIS2 reaches the suppliers of critical sectors too, which covers many integrators. ISE’s guide to NIS2 for pro AV sets out those duties.

A checklist that starts with your own engineers

Reardon’s call to action was modest: "think about it now." It does not require consultants, he said. The people who know where encryption sits are usually already on the payroll.

• Find the key pairs: list where each product line relies on public-key methods such as RSA or Diffie-Hellman, including firmware signing and remote access.
• Ask your suppliers: chipsets, operating systems and libraries decide much of that exposure.
• Check the clock: confirm whether any Linux or Unix firmware still uses signed 32-bit time.
• Put a date on it: the NCSC migration timeline asks organisations to finish discovery by 2028, migrate priority systems by 2031 and complete the move by 2035.

FAQ

• When could a quantum computer break today’s public-key encryption? Shaun Reardon of DNV Cyber cited NCSC and NIST estimates of about five years from February 2026, and said it could be sooner. The NCSC asks organisations to complete their migration to post-quantum cryptography by 2035.
• Can new algorithms run alongside RSA in existing products? Yes. Post-quantum algorithms can run in tandem with existing encryption, according to Shaun Reardon of DNV Cyber, so there is no need for a single switchover.
• Why should a display manufacturer care about 19 January 2038? On that date, Linux and Unix-based systems that store time as a signed 32-bit integer run out of room and, according to Shaun Reardon of DNV Cyber, reset to 1901. Much AV firmware runs on Linux or Unix, so manufacturers should check their code now.
• How can an AV company start on post-quantum cryptography without hiring consultants? The first step is to start thinking about it now, said Shaun Reardon of DNV Cyber, and that does not require expensive consultants. The engineers who maintain a company’s firmware can list where its products rely on public-key methods such as RSA and Diffie-Hellman.

The patient attacker is already in the building

The sharpest point in Reardon’s talk was not that quantum computers will break encryption. It was that the attack on tomorrow’s encryption starts today, with a firmware copy that is easy to take and simply waits. Kit going into a theatre or control room this year will still be there when that copy becomes readable.

That changes what responsible product planning looks like. The algorithms exist, NIST has standardised them, and they can sit beside current methods. What most businesses lack is a decision to start, and that costs a meeting with their own engineers rather than a consultant’s fee.

The cost of not deciding is stark. Reardon told the audience that 80 per cent of small and medium-sized companies that suffer a major cyber incident go bust within two years. He named no source, but his wider point stands: once encryption fails across an installed base, no patch recovers the data already taken.

Reardon spent four years leading the forensic work on a plot to blow up seven transatlantic airliners, the case behind the 100 millilitre limit on liquids in hand luggage. The quantum plot has a longer fuse, and its first step has already been taken.

About the speaker

Shaun Reardon
Head of Section - Industrial Systems Cyber Security, DNV Cyber
Reardon works on industrial cyber security from Norway after 26 years as a Scotland Yard detective specialising in digital forensics and cyber.

Explore quantum-safe security at ISE

Post-quantum planning is a growing part of the security conversation.

• Emerging technologies at ISE: security alongside AI, drones and robotics.
• The CyberSecurity Summit: where AV and IT security leaders meet.
• The wider ISE programme: summits, Megatrends and the free ISE Open stages.
• Visiting ISE for the first time? Start with the first-time visitor guide.