SpecterAI pushes independent quantum-readiness checks for banks

At HPT D-DAY 2026 in Ho Chi Minh City, Dr. Peter Huynh argued that banks and other organizations must validate quantum-safe readiness now, not wait for a quantum computer to break today’s encryption. He said migration teams can build the controls, but independent reviewers must prove they work in production.

Why it matters: - Quantum risk is already a planning problem for banks that must protect customer data, contracts and authentication systems for years. - Dr. Peter Huynh said organizations cannot rely on internal teams alone to prove quantum-safe readiness. - A failed migration could leave systems exposed while dashboards still show normal operations.

What happened: - Dr. Peter Huynh, Chairman APAC of SpecterAI Quantum Security, spoke at HPT D-DAY 2026 on October 15 at the GEM Center. - He appeared in the Real Security Session on “Quantum-Safe Security Readiness: From Discovery to Independent Validation.” - SpecterAI participated as a Silver Companion of the forum, which HPT Vietnam Corporation hosted under the theme R³: Real Technology, Real Operation, Real Result. - Huynh told attendees that organizations do not need to know the exact date quantum computers will break today’s encryption to know they must act.

The details: - Huynh framed the threat around “harvest now, decrypt later,” where attackers copy encrypted data now and wait for quantum computers to break it later. - He said RSA and elliptic-curve cryptography protect TLS and transaction signing today, but Shor’s algorithm can break both on a large enough quantum computer. - Huynh said AES-256 is weakened by quantum computing but not broken. - He pointed to NIST-standardized replacements: ML-KEM for key establishment, ML-DSA for signatures and SLH-DSA for signatures. - He used Professor Michele Mosca’s framework: if data must stay confidential for X time, migration takes Y time and a capable quantum computer arrives in Z time, then systems are already at risk when X plus Y exceeds Z. - He said the only lever leaders control is shortening Y through a disciplined program that starts now. - Huynh laid out five stages for quantum-safe readiness: discover, classify, assess, migrate and validate. - Discovery requires a full cryptographic inventory, including hidden dependencies in mobile banking libraries, ATM keys, point-of-sale terminals and core banking systems. - Classification should rank data by retention needs, with examples including one-time passwords, KYC records, 30-year mortgage contracts and root certificates. - He said biometric data needs special care because a password can be changed, but a face or fingerprint cannot. - Assessment should prioritize actual exposure instead of visibility, and hardware security modules should be checked first because they can block later migrations if they cannot support post-quantum algorithms. - Migration should use hybrid cryptography such as X25519 combined with ML-KEM-768 in TLS 1.3, plus crypto-agility and post-quantum procurement requirements. - Validation should confirm with evidence that post-quantum algorithms are running in production. - Huynh warned about “silent fallback,” where a hybrid connection can revert to classical cryptography if a partner system does not support the new algorithms.

Between the lines: - Huynh’s core message was not just about new algorithms. It was about governance. - He argued that the people who design and configure a system are least likely to spot the failure they created assumptions around. - The model mirrors internal audit and penetration testing, where implementation and assurance are separated. - His message also signals that crypto-agility is becoming a procurement issue, not just an engineering issue.

What's next: - Huynh said organizations should define what “ready” means before migration begins and agree on the evidence that will prove it. - He called for continuous validation because systems, partners and patches keep changing. - SpecterAI says it provides cryptographic assessment, independent validation and training to banks, enterprises and public-sector organizations across Asia-Pacific. - The company is headquartered in Ho Chi Minh City, Vietnam. - Huynh, also a co-founder and vice president of CIO Vietnam and a Professional Fellow of the Responsible Fintech Institute, has more than 30 years of enterprise technology experience with IBM, Salesforce, Gartner and HP.

The bottom line: - Banks can start preparing for quantum threats now, but they should not grade their own homework. Independent validation, Huynh said, is what turns migration into proof.