The fundamental challenge of quantum computing lies in its ability to solve the mathematical problems underpinning modern asymmetric encryption at speeds that are orders of magnitude faster than classical supercomputers. The computational complexity required to factor large integers, which secures RSA encryption, is drastically reduced through Shor’s Algorithm.
Market data underscores the urgency of this transition. Reports from Cloudflare Radar indicate that as of November 15, 2024, approximately 56.4% of post-quantum cryptography (PQC) capable traffic was already utilized over HTTPS, driven by broad adoption in modern web browsers like Chrome, Edge, and Firefox. By the end of 2025, this share of human-generated web traffic grew to over 52% of all TLS 1.3 request traffic, nearly doubling within a single calendar year. This surge signifies that over half of the encrypted traffic entering an enterprise network may soon be utilizing PQC standards. For a security appliance to maintain visibility and threat prevention capabilities, it must possess the ability to decrypt and inspect this traffic, as hidden malware and exfiltration attempts can easily reside within quantum-safe tunnels.
|
Metric |
Statistic/Value |
|
PQC Traffic over HTTPS (Nov 2024) |
56.4% |
|
Human Web Traffic PQC Growth (2025) |
Doubled (to >52%) |
|
NIST PQC Disallowance Deadline |
2035 |
|
Global Internet Traffic Growth (2025) |
19% |
A critical first step in the quantum-safe journey is the discovery of an organization’s cryptographic posture. Many enterprises suffer from "cryptographic debt," where legacy protocols, hardcoded certificates, and diverse encryption standards are scattered across the infrastructure without centralized oversight. Palo Alto Networks addresses this through the integration of Strata Cloud Manager (SCM) and AI-powered operations (AIOps).
For organizations utilizing Strata Cloud Manager (SCM) Pro, the platform offers a "Quantum Readiness View" within the Command Center. This dashboard provides a real-time inventory of the cryptographic behavior of all network assets, including users, IoT devices, and application endpoints. By leveraging existing network infrastructure as distributed sensors, SCM eliminates the need for manual coordination with multiple teams, a process that would traditionally take years for large enterprises.
The Quantum Readiness view categorizes the organization’s posture as:
This automated discovery of cryptography requires a Quantum-Safe App Security subscription (1HCY26) and is supported on Palo Alto VM-Series firewalls as well as Generation 4 and Generation 5 hardware platforms. While PAN-OS 11.2 supports initial PQC VPN capabilities, the recommended standard is PAN-OS 12.1 (Orion), which introduces comprehensive PQC SSL decryption and the Cipher Translation Proxy.
The choice of management platform dictates the level of visibility available for the quantum transition. Strata Cloud Manager (SCM) is the future-state management platform, offering cloud-native scale, automated policy analysis, and the full Quantum Readiness dashboard. It simplifies operations by consolidating SASE, SD-WAN, and NGFW management into a single interface.
In contrast, Panorama remains the robust choice for organizations requiring on-premises management or those in the public sector with restricted cloud access. While Panorama can configure PQC features such as site-to-site VPNs and decryption profiles, it does not currently offer the automated, consolidated "Quantum Readiness" dashboard view available in SCM. Public sector entities must instead rely on manual analysis of decryption logs and global counters to assess their infrastructure readiness.
|
Feature |
Strata Cloud Manager (SCM) |
Panorama |
|
Management Model |
Cloud-native (SaaS) |
On-premises or Private Cloud |
|
Quantum Readiness Dashboard |
Yes (Actionable widgets) |
No (Log-based analysis only) |
|
Policy Analysis |
Built-in Automation |
Limited |
|
Multi-vendor Ecosystem |
Continuous Ingestion |
Limited to PANW |
|
Subscription Requirement |
SCM Pro + Quantum-Safe |
Device-level Subscriptions |
The transition to a quantum-safe world cannot happen overnight. It requires a phase-wise approach where both classical and PQC algorithms coexist. This hybrid period presents significant interoperability challenges: a client supporting only PQC might attempt to connect to a legacy server that only understands classical RSA, leading to a session failure.
Palo Alto Networks solves this interoperability gap with the "Cipher Translation Proxy" introduced in PAN-OS 12.1 Orion. This intelligent proxy acts as an intermediary layer at the network edge, translating classical cryptographic communications into quantum-safe standards and vice versa. This "virtual patching" capability allows organizations to bolster their security without overhauling legacy code or hardware, potentially saving millions of dollars in application modernization costs.
The mechanism functions through a hybrid key exchange, which combines a classical algorithm (e.g., ECDHE) with a post-quantum key encapsulation mechanism (KEM), such as ML-KEM (Kyber). This ensures "dual resistance," where the session is secured against both today's classical attackers and future quantum adversaries.
As PQC becomes the default for browsers, the role of decryption becomes even more critical. If a firewall cannot decrypt PQC-based TLS 1.3 sessions, it loses the ability to perform Content-ID, App-ID, and WildFire analysis on more than half of its traffic. PAN-OS 12.1 enables Next-Generation Firewalls to decrypt and inspect PQC traffic at scale, ensuring that the transition to more secure encryption does not create a blind spot for traditional threats.
The decryption process involves:
The increased complexity of PQC algorithms imposes a heavier computational load on network security appliances. While Generation 4 hardware (PA-400, 1400, 3400, 5400) is "Quantum-Ready", meaning it has the necessary libraries and OS support for PQC, high-traffic environments require "Quantum-Optimized" Generation 5 hardware to maintain performance.
Generation 5 firewalls, such as the PA-7500 and the newly announced PA-5500 Series, are built on the custom FE-400 ASIC. This revolutionary hardware component is designed for massive parallel processing, achieving unparalleled scale and low latency for encrypted traffic inspection. The PA-5500 series, for example, delivers up to 4x the threat performance of the previous generation PA-5400 series, supporting up to 300 Gbps of threat prevention throughput in a compact 3RU form factor.
For customers currently operating on Generation 3 (Gen-3) hardware (e.g., PA-5200 or PA-7000 Series), the shift toward quantum security creates a natural hardware refresh opportunity. Gen-3 hardware is fundamentally incapable of supporting the PQC libraries and performance requirements of the quantum era. Migrating these environments to the PA-5500 series provides:
A significant point for the PA-5500 is the roadmap for QRNG integration. While PQC focuses on the resistance of mathematical algorithms, QRNG addresses the quality of the randomness used to generate cryptographic keys. Classical random number generators can be deterministic and potentially predictable; QRNG uses quantum mechanics to ensure true randomness. The inclusion of a dedicated PCI slot for QRNG hardware, ensures that Gen-5 platforms will remain the gold standard for security throughout the next decade.
|
Model |
Generation |
Threat Throughput |
Form Factor |
Key Hardware Feature |
|
PA-5580 |
5th Gen |
300 Gbps |
3RU |
FE-400 ASIC, Quantum Optimized |
|
PA-7500 |
5th Gen |
1,440 Gbps |
14RU Chassis |
Modular Scale, FE-400 ASIC |
The initiative must be nuanced based on the customer’s operational constraints and data sensitivity.
Public sector organizations often maintain air-gapped or strictly on-premises networks that disallow SaaS-based management like Strata Cloud Manager (SCM). In these environments, the focus shifts to visibility and control available directly on the firewall or via Panorama.
For commercial enterprises embracing AI and multicloud, SCM Pro is the recommended management path. These organizations benefit from:
To effectively initiate these conversations, Business Development Representatives (BDRs) should utilize specific discovery tracks based on the customer’s existing management and hardware state.
If the customer is already utilizing SCM Pro or Panorama with AIOps, the message should focus on "unlocking" the hidden value of their existing data.
If the customer is using older hardware, the message is a performance and future-proofing play.
For the public sector, the focus is on resilience and compliance without the cloud.
The migration to a quantum-safe posture should follow a structured, three-step framework that prioritizes business continuity and data shelf-life.
Identify every application, API endpoint, and device using encryption. Organizations should prioritize "forever data"—records in healthcare, government, or finance that must remain confidential for 20+ years. The SCM-based Crypto Inventory is the primary tool for this phase.
Once risks are prioritized, organizations should:
Infrastructure should be progressively refreshed to Generation 5 hardware to accommodate the performance demands of full PQC inspection. This phase includes the integration of QRNG for high-entropy key generation and the implementation of Active Drift Detection to maintain long-term crypto-hygiene.
The arrival of the quantum era demands a paradigm shift in network security. It is no longer sufficient to secure a network against the threats of today; security must be architected for the threats of a decade from now. Palo Alto Networks, through the PAN-OS 12.1 Orion release and the Gen-5 hardware portfolio, provides the industry's first complete framework for quantum readiness.
By combining automated discovery, intelligent translation, and performance-optimized hardware, organizations can navigate the "leap" to a post-quantum world with minimal disruption to their existing operations. For the Business Development Representative, the opportunity lies in helping customers realize that quantum readiness is not an optional upgrade but a fundamental requirement for maintaining data integrity in an increasingly complex and adversarial landscape. The time for action is now—leveraging the data, tools, and platforms already available to secure the digital foundations of the next generation.
NGFW #Quantum
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.
| Subject | Likes |
|---|---|
| 4 Likes | |
| 4 Likes | |
| 3 Likes | |
| 2 Likes | |
| 2 Likes |
| User | Likes Count |
|---|---|
| 7 | |
| 6 | |
| 4 | |
| 2 | |
| 2 |
