Karen Kelvie | Product Marketing, Data Protection
More About This Author >
Karen Kelvie | Product Marketing, Data Protection
More About This Author >
Every hour developers spend changing an application to accommodate data security is an hour they aren't building products that generate profit. As businesses race to bring AI-powered products to market, pulling developers away from product development becomes increasingly expensive.
Security requirements keep changing, making security updates an ongoing operating expense.
Over time, the business pays repeatedly: through postponed revenue-generating work and the recurring expense of security updates.
The cost extends beyond Development. Test must validate the changes, and IT must deploy the revised code to Production. Every security update consumes resources that could be working on revenue-generating projects.
What is crypto agility?
Crypto agility (also called cryptographic agility) is the ability to replace cryptographic algorithms, keys and parameters in applications and infrastructure without rewriting code or disrupting operations. In data protection, a crypto-agile platform lets a Data Security Admin change an encryption cipher or rotate keys through centrally managed policy, so a security update becomes an administrative task instead of a development project.
The cost of security updates depends on how they're made: in code or by policy
When calculating the cost of security updates, it comes down to which strategy you use. This is a moment to review your options apart from sunk costs.
If your data protection solution requires security updates to be made in code, then you have the scenario described above, and each of your security updates may lag as long as two years while you wait for Development, Test and IT to become available and make your project their top priority. Once they start on your security update, the writing, testing and deployment of updated code will take a minimum of two months. This is the scenario you hope applies to your competitors.
If your data protection solution is a centrally managed, policy-based, crypto-agile platform, the timeline for security updates changes dramatically in your favor. Development, Test and IT are unaffected, so their schedules are no longer dependencies and you avoid the corresponding recurring costs. A Data Security Admin can update your security in real time, potentially in less than two minutes.
According to the 2026 Thales Data Threat Report (p. 4), 53% of organizations are funding AI security from their existing security budgets. As security requirements expand, organizations have even more reason to eliminate unnecessary recurring costs.
Security updates are an ongoing requirement. When you choose your solution you are choosing whether the pain of security updates will be ongoing.
Crypto agility reduces security costs and exposure
Without interrupting business operations, crypto agility enables data security updates to take effect immediately, closing cryptographic security gaps in real time. Instead of requiring a Development team to install the updates, a crypto agile solution enables a Data Security Admin to change an encryption cipher or rotate encryption keys from a simple dropdown menu.
NIST's Considerations for Achieving Crypto Agility: Strategies and Practices (CSWP 39, updated June 2026, p. 2) describes the goal for computing systems: "In a system, crypto agility is the ability to adopt new cryptographic algorithms and stop the use of vulnerable algorithms in applications without disrupting the running system."
As computing advances, vulnerabilities emerge, and security requirements evolve, cryptography must change. NIST notes that each traditional cryptographic transition "is costly, takes time, raises interoperability issues, and disrupts operations."
Crypto agile data protection can shrink recurring costs, remove the need for developers to be involved in security updates, and reduce the lag between identifying and implementing a required security update from a minimum of two months to potentially less than two minutes.
Post-quantum cryptography (PQC) relies on crypto agility to get ahead of Q-Day
For data protection, crypto agility reduces the cost and delay of security updates. For communication protocols such as TLS, crypto agility helps maintain interoperability when organizations introduce new algorithms.
In the same paper, NIST states that "all public-key algorithms will need to be replaced rather than just a single algorithm. These algorithms have been used for decades to protect every communication link and digital device." Translated into business-speak, global digital communications, banking and government secrets are all at high risk.
The moment when the existing public-key algorithms fail is referred to as “Q-Day.” Nobody knows its exact date, but Gartner predicts that by 2029 advances in quantum computing will make conventional asymmetric cryptography unsafe to use, and that by 2034 it will be fully breakable. The ironic twist is that we can’t wait until Q-Day to protect sensitive data, because attackers can collect encrypted data today and retain it for future decryption. This is known as "harvest now, decrypt later" (HNDL). Data that must remain confidential for years needs protection against future quantum attacks today, and yesterday.
The threat is already influencing security priorities. According to the 2026 Thales Data Threat Report (p. 18), 61% of respondents identify harvest now, decrypt later as their leading quantum concern, and 59% are already prototyping and evaluating post-quantum cryptographic (PQC) algorithms.
Measure the total cost of data protection over years
When evaluating data protection, calculate the total cost of ownership over years, including the expense of future security updates and the cost of lost opportunity. Choose an architecture that allows security to adapt without slowing the business.
Thales has been delivering centrally managed, policy-based, crypto agile data protection since 2021, enabling customers to shrink recurring expenses and vulnerability windows, and enabling their developers to stay focused on building products that generate profit.
Learn about the Thales CipherTrust Data Security Platform (CDSP) and field-level data protection that enable Data Security Admins to update data security in real time.
Not sure how crypto agile your environment is today? Take the free Post-Quantum Crypto Agility Risk Assessment to see where you stand.
Download the 2026 Thales Data Threat Report for further insights into how CDSP can support your strategy.
Crypto agility FAQ
How does NIST define crypto agility?
Crypto agility is the ability to replace cryptographic algorithms and keys without rewriting applications or disrupting operations. NIST describes it as the ability to adopt new algorithms and stop using vulnerable ones "without disrupting the running system." In data protection, it lets a Data Security Admin change ciphers and rotate keys through centrally managed policy.
How does crypto agility reduce the cost of security updates?
When encryption is built into application code, every cipher change or key update becomes a development project that also needs testing and deployment. With centrally managed, policy-based data protection, a Data Security Admin makes the change once, so development, test and IT schedules are no longer dependencies and the recurring cost of each update shrinks.
What is Q-Day?
Q-Day is the point at which a quantum computer can break today's public-key algorithms, such as RSA and elliptic-curve cryptography. Its exact date is unknown. Gartner predicts these algorithms will be unsafe to use by 2029 and fully breakable by 2034.
What is harvest now, decrypt later?
Harvest now, decrypt later (HNDL) is an attack in which adversaries steal encrypted data today and store it until a quantum computer can decrypt it. In the 2026 Thales Data Threat Report, 61% of respondents named HNDL as their top quantum concern. Data that must stay confidential for years needs quantum-safe protection now.
Why does post-quantum cryptography require crypto agility?
Moving to post-quantum cryptography (PQC) means replacing every public-key algorithm, not just one, and standards will keep evolving. Crypto-agile systems can adopt new NIST algorithms and retire vulnerable ones through configuration rather than code rewrites, which makes the transition faster, cheaper and repeatable.