Our Services
A measured, evidence-led baseline of your quantum exposure. We identify which systems and datasets carry potential post-quantum risk, benchmark your posture against NZISM and frameworks, and characterise the threat honestly, including where there is no threat worth acting on. You finish with a clear picture and a defensible priority order.
Exposure snapshot, NZ$4,500 + GST. An external read of every public domain, mail exchanger and certificate you run, a discovery session, a shelf-life inventory of your most important datasets, an NZISM 2.4 gap check, and a short written report with a priority order. About two months.
Full readiness snapshot, NZ$12,500 + GST. Everything above, plus an inside cryptographic inventory of the systems that protect your long-lived data (keys, certificates, libraries, protocols), a supplier readiness check industry-standard vendor questions, a frozen point-in-time baseline for future re-scans, a board-ready report, and a leadership briefing. About three to four months.
A phased, costed transition plan for the systems that warrant it. We sequence the work against your operational constraints, supplier dependencies and regulatory timeline, using hybrid strategies that keep you interoperable throughout. This is the organisational programme, not a cryptographic parts swap. The hard part of PQC migration is the coordination, and coordination is what the roadmap manages. From there we work the plan together, staying agile as new or unexpected challenges arise. Our flexibility and transparency keep the migration fluid.
Related report: Everyone else just set a date
Standards move, suppliers ship, and your own systems change. A regular re-scan and review keeps your baseline current, tracks your suppliers’ readiness, and flags what has shifted since the last point of reference. This way quantum risk stays a managed line item rather than an ad hoc audit. We keep up to date with the frameworks, standards, regulatory policies and guideline updates and will advise you when action or change is recommended or necessary.
Related report: Seven weeks later: NZ critical infrastructure PQC, June 2026
Recent Updates
NIST has published the final version of its post-quantum transition roadmap. Every quantum-vulnerable public-key algorithm is deprecated after 2030 and disallowed after 2035, and US federal high-value systems get harder deadlines still. New Zealand still has none of its own. Reference: Moody D, Perlner R, Regenscheid A, Robinson A, Cooper D. Transition to Post-Quantum Cryptography…
The post-quantum cryptographic answers are now largely agreed. Applying them — especially to authentication — is the hard part. Cloudflare’s move to become a certificate authority shows one way it gets done for the web. Bitcoin shows why the same answer doesn’t transfer everywhere. And Europe’s €47.5 million quantum-internet bet won’t help anyone migrating before…
In short Kaysec publishes two fixed prices for a post-quantum cryptography (PQC) readiness assessment in New Zealand: an Exposure snapshot at NZ$4,500 + GST, which takes about two months, and a full Readiness snapshot at NZ$12,500 + GST, which takes about three to four months. A one-minute external check is free. Exposure snapshot, NZ$4,500 +…
In short Not directly. ASD’s timeline is Australian guidance: a refined transition plan by the end of 2026, migration commencing in 2028 and complete by the end of 2030. It reaches a New Zealand business indirectly, most often through an Australian parent company, an Australian customer, or systems shared with either. What ASD’s guidance says…
In short NZISM Section 2.4 is the part of the New Zealand Information Security Manual that deals with post-quantum cryptography (PQC). It requires agencies to monitor PQC developments, inventory their cryptographic systems and develop migration plans. No PQC algorithms have yet been approved for NZISM use, and no migration deadline has been set. What Section…
In short No. New Zealand remains the only Five Eyes member with no post-quantum migration deadline. NZISM Section 2.4 asks agencies to monitor post-quantum cryptography (PQC) developments, inventory their cryptographic systems and develop migration plans, but it sets no date. What others have set Other jurisdictions have moved from guidance to dates: United States. Executive…
Six stories broke in the space of three weeks in September 2026, and none of them, on its own, looks like big news. Read together, they mark a shift in what “post-quantum readiness” means. For two years the industry conversation has been about which algorithm to pick and when to switch it on. That question…
The world has agreed on the maths of post-quantum cryptography. It has not agreed on how to use it — and the traffic on the wire has already changed shape. Four developments from the past fortnight, and what they mean for New Zealand. There is a comfortable version of the post-quantum story in which the…
Standfirst: A validated hardware security module, a bill aimed at the electricity grid, and a Finnish research programme pointing at the certificate layer. Three developments in one week say the same thing: the hard part of the post-quantum transition is no longer cryptographic. A fourth — a vendor blog doing the rounds again — is…
What “harvesting” encrypted data really costs an adversary, what it would take to read the stockpile, and where the actual threat is hiding. This article walks a five-gate framework (physical access, storage economics, decryptability, data shelf life, and adversary motive) from first principles, and grounds it in an original internet-wide scan of what post-quantum cryptography…
English
日本語
简体中文
한국어