Dr. Renu Ann Joseph, Founder and CEO of Luminant Analytics, is an entrepreneur, date scientist, and business economist who focuses on the intersection of data science, quantum technology, AI and the insurance/ reinsurance sector. Dr. Joseph spoke about the implications of Post-Quantum Cryptography for the insurance/reinsurance sector at AIRROC’s 2026 Legacy Transactions & Networking Forum. A video replay of this presentation is available on the AIRROC On Demand platform.
Powerful quantum computers could eventually break widely used public-key systems such as RSA and elliptic-curve cryptography. Post quantum cryptography (“PQC”) is a new generation of encryption and digital signature methods designed to resist attacks from future quantum computers. PQC consists of new cryptographic algorithms designed to run on ordinary computers while resisting attacks from both classical and quantum computers.
Here are the top takeaways from Dr. Joseph’s observations and presentation.
- Regulatory considerations for offering insurance to businesses: There is a federal deadline looming to transition federal information systems to NIST-approved post-quantum cryptography starting in September 2026 by the end of 2035. We are no longer in the realm of uncertainty of whether a quantum computer will break encryption; rather regulatory agencies are providing direction on what needs to happen now, anticipating the scope of incursion. As an insurer (reinsurer) starts writing policies for businesses touching government infrastructure, this needs to be factored in as a risk variable.
- The risk has already started due to the concept of “Harvest Now, Decrypt Later.” An attacker can steal encrypted data today, store it, and wait until a sufficiently capable quantum computer exists for it to be hacked. Long-tail liabilities can create long-tail cybersecurity exposure.
- The insurance value chain is a fertile ground for digital vulnerability. Customer and policy data, claims and medical date, payments and banking details, contracts and digital signatures are all data points that are at risk.
- The key is to start now, move quickly with the understanding that not every system needs to be replaced. Migration takes years and the world’s top companies have been working on it for a while, but you do not need it rip it all apart. Some layers only need adjustment; others will need to be rebuilt completely. Transitioning to PQC is a strategic shift that requires assessing current cryptography, updating systems and processes.
In summing up her presentation, Dr. Joseph urged the audience to start the journey now and be more proactive in light of the myriad of risks facing the legacy industry. There is no need for fear mongering; informed action is the key to avoid a crisis response tomorrow.
