Post-Quantum Cryptography & Security Knowledge Base

Browse by topic

• 8 articlesPost-Quantum CryptographyGuides to the NIST post-quantum standards, hybrid TLS, cryptographic inventories and migration planning.
• 5 articlesApplication & API SecurityPractical guidance on API security, business logic flaws, secrets management and secure CI/CD pipelines.
• 4 articlesAI & LLM SecurityDefending applications built on large language models: prompt injection, agent permissions, RAG security and AI-assisted code review.
• 7 articlesAgentic AIHow AI agents are built and secured: architecture, tool protocols such as MCP, multi-agent systems, approvals, identity, testing and observability.
• 7 articlesGenerative AIBuilding and governing generative AI applications: RAG, hallucinations, choosing between fine-tuning and prompting, privacy, supply chain and cost controls.
• 2 articlesCloud Security & ComplianceLeast-privilege IAM, serverless hardening and automating audit evidence for frameworks such as SOC 2.

New to post-quantum cryptography? Start here

A three-step path: why the threat exists today, how the main new algorithm works, and what the standards and timelines mean for your organization.

1. 1
   Harvest Now, Decrypt Later: The Quantum Threat That Already Applies Today

   Why encrypted data captured today can be a liability years from now, how to judge whether your data is at risk, and which mitigations actually reduce exposure.

2. 2
   Demystifying ML-KEM: How NIST's Post-Quantum Key Exchange Works

   A plain-language explanation of ML-KEM (FIPS 203): the lattice problem behind it, how key encapsulation works, parameter sets and sizes, and what changes for engineers.

3. 3
   The NIST Post-Quantum Standards Era: What Security Leaders Need to Know

   An executive overview of FIPS 203, 204 and 205, the draft NIST IR 8547 transition timeline, and a practical plan for budgeting and governing a cryptographic migration.

• Agentic AI • 4 min readAI Agent Identity and Authorization: Credentials, Delegation and Least PrivilegeHow to give agents their own identities, use short-lived scoped tokens, delegate on behalf of users safely, and enforce permissions in the tools rather than in prompts.
• Generative AI • 3 min readAI Supply Chain Security: Models, Datasets and Safe SerializationWhy downloading a model is like running untrusted code, the risks in pickle-based model files, how to verify provenance, and how to build an AI bill of materials.
• Post-Quantum Cryptography • 3 min readBuilding a Cryptographic Inventory (CBOM): A Practical MethodHow to discover and record every place your organization uses cryptography, using code scanning, network discovery and certificate data, and how a CBOM differs from an SBOM.
• Generative AI • 4 min readCost and Abuse Controls for LLM APIs: Rate Limits, Budgets and Denial-of-WalletHow to protect an LLM-backed application from runaway spending and abuse using layered limits, authentication, quotas, caching, input caps and monitoring, with a serverless example.
• Post-Quantum Cryptography • 3 min readCrypto-Agility: Design Patterns for Swappable CryptographyConcrete patterns for building systems that can change algorithms without rewrites: abstraction layers, algorithm identifiers, versioned envelopes, dual-write rotation and policy as configuration.
• Generative AI • 4 min readData Privacy When Using Generative AI at Work: A Practical Policy GuideWhat happens to data you send to AI tools, the main privacy risks (leakage, retention, training use, shadow AI), and how to write an acceptable-use policy employees will follow.

Free tools and products

• PQC Readiness CalculatorEstimate post-quantum risk and a migration timeline from your stack, algorithms and infrastructure.
• Code Security SandboxPaste a snippet to see hardcoded secrets and weak cryptography flagged, with a suggested diff.
• GitGuard PortalRequest a sandbox API key for the GitGuard CI/CD scanner and check usage quotas.
• CompliAIHow automated rule checks and CBOM generation support continuous cloud compliance.