.svg)
.png)
Gartner® Research
CISO Agenda Priority: Transition to Postquantum Cryptography Before It's Too Late (And Too Expensive)
Access a complimentary copy of the Gartner® report, part of The CISO Agenda for 2027 series.
Customer Spotlight
“Elisity has changed how we look at microsegmentation solutions overall and we have now experienced how Elisity is the easiest to implement and easiest to manage.”
— Aaron Weismann, CISO, Main Line Health
The Gartner® Insights
What Does the Gartner® Report Recommend CISOs Deliver Before the End of 2026?
Capability 1
Establish a cryptographic center of excellence
"Give a cross-functional CCoE authority to set policy, maintain the cryptographic inventory, manage exceptions and coordinate the enterprise transition."
Capability 2
Deliver cryptographic inventory as a managed operational capability
"Continuously discover cryptography across IT, operational technology (OT), cyber-physical systems (CPS), cloud, software, data platforms, identity and access management (IAM), nonhuman identities and third parties."
Capability 3
Convert findings into remediation workstreams
"Separate vendor dependencies, custom-built applications, legacy systems and classical cryptographic debt into accountable programs with common milestones and reporting."
Capability 4
Make quantum readiness a supply chain requirement
"Require vendors to disclose current cryptography, replacement plans, delivery mechanisms, compatibility constraints, performance effects and support commitments."
Capability 5
Plan containment or accelerate the retirement of systems that cannot migrate
"Use encapsulation, cryptographic shims or PQC-protected channels only as governed interim measures and reconsider retirement timelines where durable remediation is impractical."
Planning Assumption
The cost of delay
"By 2030, the cost of transitioning to PQC will double for every year an organization delays beginning a coordinated program after 2026."
Capabilities and planning assumption quoted from Gartner, CISO Agenda Priority: Transition to Postquantum Cryptography Before It's Too Late (And Too Expensive), Mark Horvath, Sarah Almond, Thomas Lintemuth, 17 September 2026. See the report for the full guidance.
Why Now?
PQC Is on the
CISO Agenda for 2027
"CISOs must start postquantum cryptography (PQC) transition now or face doubling costs every year it's delayed."
Gartner, CISO Agenda Priority: Transition to Postquantum Cryptography Before It's Too Late (And Too Expensive)
From the Gartner® report:
-
"PQC transition requires strong action today, not tomorrow."
-
"[A] 2026 Gartner survey of CISOs found that 45% of CISOs say their organization hasn't begun any PQC-related activities, and another 39% are only in the planning and early testing stages."
-
"The business risks include harvest now, decrypt later (HNDL) that threatens encrypted data."
-
"Most organizations underestimate their cryptographic footprint. Cryptography is embedded in infrastructure, applications, data stores, pipelines, cloud and SaaS services, IAM, nonhuman identities, OT and CPS, unmanaged assets, and vendor integrations."
Get the Gartner® Report
CISO Agenda Priority: Transition to Postquantum Cryptography Before It's Too Late (And Too Expensive)
Access a complimentary copy of the Gartner® report by Mark Horvath, Sarah Almond and Thomas Lintemuth, part of The CISO Agenda for 2027 series.
Proven Across 15 Hospitals
at St. Luke’s University
Health Network
14 days
From deployment to first active segmentation policy
15 hospitals
Network-wide, surgical robots online throughout, acquisitions onboarded in weeks
2-3 sites / wk
Site rollout pace across the network
83%
Of critical policies enforced within 90 days
See it on Your Own Network
Walk through discovery, simulation, and enforcement with our team, on the infrastructure you already own.
About the Gartner® Report
CISO Agenda Priority: Transition to Postquantum Cryptography Before It's Too Late (And Too Expensive) is a Gartner® report by Mark Horvath, Sarah Almond and Thomas Lintemuth, published 17 September 2026 as part of the Gartner series The CISO Agenda for 2027. The report discusses why CISOs need to begin the transition to postquantum cryptography (PQC) now, noting that progress on PQC migration so far has been inadequate and that costs rise the longer a coordinated program is delayed. It also discusses establishing an enterprisewide governance model that turns cryptographic discovery into coordinated remediation across vendor products, custom-built applications and legacy systems.
CISOs, security architects, and the IT, OT and risk leaders who plan cryptography programs.
Select Read the Report on this page for complimentary access to the Gartner® report, provided by Elisity.
Recognized Across Gartner Research
Elisity was named a Cool Vendor in the Gartner® Cool Vendors™ in Cyber-Physical Systems Security 2025.
Elisity was recognized as a Sample Vendor in the Gartner® Hype Cycle™ for Enterprise Networking, 2025
Elisity was recognized as a Representative Vendor in the 2025 Gartner® Market Guide for Network Security Microsegmentation.
Gartner, Hype Cycle, and Cool Vendors are trademarks of Gartner, Inc. and/or its affiliates.
Gartner does not endorse any company, vendor, product or service depicted in its publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner publications consist of the opinions of Gartner’s business and technology insights organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this publication, including any warranties of merchantability or fitness for a particular purpose.