OT asset owners are being required by regulators to attest to post-quantum cryptographic readiness, but the tooling and frameworks to actually verify this don't exist for OT environments. Unlike IT systems, OT devices often run on decades-old hardware with minimal RAM, hard-coded firmware, and no ability to be patched without physical access. Adversaries like Volt Typhoon may have already harvested encrypted OT traffic for future decryption ('harvest now, decrypt later'), and stolen firmware signing keys could enable future malicious updates. The result is that organizations are filing compliance paperwork without genuine security assurance, creating a false sense of readiness that may be more dangerous than acknowledged uncertainty.
Sort: