Which Connections Do You Make Quantum-Safe First?

Connections that transport sensitive or long-term valuable data deserve quantum-safe security first. Think of data center connections, government networks, healthcare infrastructure, and financial backbones. The reason is simple: attackers are already intercepting encrypted traffic to decrypt it later once quantum computers are powerful enough. This article addresses the most urgent questions surrounding quantum-safe connections, from risk assessment to phased migration and regulation.

Which connections are already at risk from quantum computing?

Connections that are already at risk are those where encrypted traffic is intercepted and stored for future decryption. This pattern is known as “harvest now, decrypt later.” Every connection that today uses RSA- or ECC-based encryption and transports data with a long confidentiality period is vulnerable. This applies to government networks, medical records, financial transactions, and critical infrastructure.

The threat is not hypothetical. Nation-state actors and advanced cybercriminals have been collecting encrypted network traffic for years. They are waiting for the moment when quantum computers are powerful enough to crack the underlying mathematical problems on which classical network encryption is based. For data that must remain confidential ten or twenty years from now, the deadline has effectively already passed.

Connections with the highest risk profile include:

• WAN connections between data centers carrying confidential business or patient data
• Fiber connections for government and defense communications
• Financial clearing and settlement networks
• Industrial control networks for critical infrastructure such as energy and water
• Connections that transport intellectual property or strategic information

What is the difference between layer 1, layer 2, and layer 3 encryption in quantum security?

The difference lies in where in the network model the encryption takes place and what data is protected by it. Layer 1 encryption encrypts the physical signal on fiber, layer 2 encryption operates at the Ethernet level, and layer 3 encryption protects IP packets. For quantum security, the lower the layer, the broader the coverage and the less overhead.

Layer 1 encryption: protection at the physical signal

Layer 1 encryption encrypts the optical signal directly on the fiber, before data is converted to higher protocols. This offers maximum protection because all data traveling over that connection is automatically encrypted, regardless of the protocol above it. There is virtually no latency and the security is transparent to all overlying systems. This makes layer 1 encryption particularly suitable for data center interconnects and critical backbone connections.

Layer 2 encryption: security at the Ethernet level

Layer 2 encryption operates at the level of Ethernet frames and offers granular control per connection or VLAN. It is more flexible than layer 1 and supports segmentation of traffic flows. Layer 2 solutions are well suited for metro networks, campus environments, and connections between branch offices. Performance is high and compatibility with existing infrastructure is broad.

Layer 3 encryption: security at the IP level

Layer 3 encryption, such as IPsec, operates at the IP packet level and is the most widely used form in traditional networks. It offers flexibility over the internet and is broadly supported. The disadvantage for quantum security is that most layer 3 solutions rely on RSA or elliptic curve cryptography, which are vulnerable to quantum attacks. Post-quantum cryptography at layer 3 is under development, but migration is more complex than at layer 1 or 2.

How do you determine which connections deserve the highest priority?

Priority is determined based on three factors: the sensitivity of the data, the longevity of the confidentiality requirement, and the criticality of the connection to business processes. A connection that transports medical records or financial data with a confidentiality period of more than five years immediately has high priority. Connections that only carry routine operational traffic can be addressed later.

A practical prioritization model works as follows:

1. Inventory all connections and categorize the data passing over them by type and sensitivity.
2. Determine the confidentiality horizon: how long must the data remain secret? Anything beyond five years is urgent.
3. Assess criticality: which connections are business-critical? The compromise or failure of which connection would have the greatest impact?
4. Analyze current encryption: which connections use vulnerable algorithms such as RSA-2048 or ECDSA?
5. Combine the scores into a risk ranking and start at the top.

Our approach at Netways Europe is always consultative: we help you carry out this inventory and translate the outcomes into a concrete migration plan. That way you know exactly where to start and what the next step is.

Which sectors need to switch to quantum-safe connections first?

The sectors that need to switch first are those where data has a long confidentiality horizon, where failure or data theft causes direct societal harm, or where strict regulation applies. These are primarily government and defense, healthcare, financial services, and critical infrastructure such as energy, water, and transport.

For the healthcare sector, patient data must remain confidential for decades. A hospital that does not implement protection against quantum threats today risks having intercepted traffic from now become readable within a few years. The same applies to educational and research institutions protecting intellectual property for the long term.

Data centers and cloud providers also rank high on the priority list. They transport enormous amounts of data from a wide range of customers, meaning a vulnerability in their backbone connections can cause damage on a much larger scale. The maritime and transport sectors follow closely, especially where operational technology is connected to public networks.

How does a phased migration to quantum-safe networks work?

A phased migration to quantum-safe networks proceeds in three main phases: inventory and risk analysis, replacement of the most urgent connections, and gradual rollout to the rest of the infrastructure. The key is not to try to replace everything at once, but to start where the risk is greatest and systematically expand from there.

Phase 1: insight and preparation

Start with a complete inventory of your cryptographic assets. Which algorithms do you use, on which connections, and what data passes over them? This gives you a cryptographic map of your network. Combine this with the prioritization method from the previous section to draw up an ordered migration list. Also involve your vendors in this phase: not all hardware supports post-quantum algorithms via a firmware update.

Phase 2: migration of high-priority connections

Start with the connections that carry the highest risk. Implement quantum-safe encryption at layer 1 or layer 2 for data center interconnects and backbone connections. Prefer crypto-agile solutions: systems that support multiple encryption algorithms and can be easily updated as standards evolve. This prevents you from having to start over in five years.

Phase 3: broad rollout and assurance

Roll out quantum-safe connections step by step to less critical segments. Ensure that new connections and hardware you procure are quantum-safe by default. Establish a review cycle to periodically assess the cryptographic standards in your network against the latest insights from standardization organizations such as NIST. Security is not a one-time project but an ongoing process.

When is quantum-safe encryption mandatory under NIS2 and other regulations?

NIS2 requires organizations in essential and important sectors to take appropriate technical measures to manage risks to the security of network and information systems. Although NIS2 does not mention quantum-safe encryption by name, protecting against foreseeable threats such as quantum computing falls explicitly under this duty of care. By 2026, regulators expect organizations to demonstrably be working on quantum risk management.

In addition to NIS2, other frameworks play a role. The European cybersecurity strategy and ENISA guidelines are increasingly steering toward post-quantum cryptography as the standard. For the financial sector, additional requirements apply under DORA, which sets comparable technical security obligations. Government and defense organizations are subject to national and NATO guidelines that already prescribe quantum-safe communications more concretely.

The practical consequence is that you must already be able to demonstrate that you have conducted a risk analysis and drawn up a migration plan. Waiting until encryption is formally mandated is too late. Regulators look at audits and incidents for the demonstrable diligence with which your organization has identified and addressed risks. A documented approach to protecting sensitive data is therefore not only technically prudent, but also legally necessary.

Want to know where your network stands today and which connections need to become quantum-safe first? Our experts will help you with a concrete analysis and a clear action plan, tailored to your sector and infrastructure.