How I learned to stop worrying and build a CBOM - practical steps for quantum resilience

The Australian Cyber Security Centre advises that while quantum computing is not an immediate operational threat, organisations must begin preparation now to ensure the security structures they rely on can withstand a quantum-enabled world. Building secure technology for the future requires planning years in advance—and the CBOM is the essential starting point. This session provides a practical blueprint for shifting from awareness to action. 

The race to build secure technology for a quantum future has begun—and organisations that delay may find their foundational security controls suddenly obsolete. For years, quantum computing sat comfortably in the “future threat” category, noted but rarely prioritised. But recent global advances, paired with updated guidance from national cyber authorities, make it clear that building quantum-resilient systems must start now. Preparing isn’t about fear—it’s about engineering resilience before the stakes escalate.

This session reframes quantum preparedness as a design challenge: how do we build security that will survive the next computing revolution? Participants will gain a practical understanding of what quantum capability means for traditional encryption models and why asymmetric cryptography—one of the core load-bearing beams of modern digital architecture—faces the greatest structural risk. 

At the centre of this effort is constructing a Cryptographic Bill of Materials (CBOM): a detailed architectural blueprint of where and how an organisation’s cryptography is embedded. Like any major engineering project, you cannot reinforce what you cannot see. A CBOM forms the foundation upon which a secure, quantum-ready technology stack can be built, strengthened, and maintained over time. 

Attendees will learn how to begin designing their enterprise transition to post-quantum cryptography (PQC), which platform dependencies matter most, how to plan for OT environments, and how to rehearse operational continuity if quantum-enabled disruption arrives sooner than expected. The session repositions PQC not as a looming crisis, but as a timely opportunity to build stronger, more resilient technology for the decade ahead.

Key Takeaways

1. Why organisations must begin engineering quantum-resilient systems today, given the multi-year effort required to prepare enterprise cryptographic environments. 
2. How quantum capability impacts symmetric vs asymmetric encryption, and why the latter forms a structural weak point in today’s security architecture. 
3. The security consequences of quantum cryptography and quantum key distribution—new technologies that will redefine what “secure communication” means in national infrastructure and critical systems. 
4. How to design and build a CBOM, including what components to catalogue across IT and OT environments and how to transform it into a long-term architectural asset. 
5. Strategic considerations for coordinating with vendors, managing platform roadmaps, and reinforcing operational continuity plans.
6. Overview of emerging PQC-resistant algorithms, including CRYSTALS-Kyber and CRYSTALS-Dilithium, which will form key construction materials in tomorrow’s secure technology stacks. 

​