At the Quside Showcase Day 2025 – The Entropy Nexus, experts from the financial and cybersecurity sectors gathered to discuss one of the most pressing challenges of the decade: how to prepare the financial industry for the post-quantum era.
Moderated by Carlos Abellán, CEO of Quside, the panel brought together Jaime Gómez (Global Head of Quantum Threat Program, Banco Santander), Itan Barmes (CSO, QIZ Security), and Luis Jiménez (Director of the Technological Center of the Spanish Notarial Council). Together, they shared a realistic yet forward-looking view of the path from strategy to implementation.
“What we’re doing today to protect information will be completely different from what we’ll be doing in 2035,” said Abellán. “This decade is about transition — a marathon that every organization must begin.”
Starting the Quantum Security Marathon
Jaime Gómez opened the discussion by emphasizing the urgency of turning awareness into action. “The challenge is not understanding the quantum threat — it’s acting on it,” he noted.
He recalled that while the new post-quantum algorithms are still being standardized, several are already implemented in practice. “The most important thing is to get the ball rolling,” Gómez said. “Once you take that first step — even if it’s adopting hybrid approaches in browsers or internal systems — you break the barrier of inaction.”
“A marathon begins with the first step,” he reminded. “And in cybersecurity, waiting for the perfect conditions means starting too late.”
The Role of Standards and Regulation
From his perspective as a former Deputy Director of Spain’s National Cryptologic Center, Luis Jiménez highlighted the importance of global standards and certification processes.
“Since 1977 we’ve all relied on cryptography published by NIST,” he explained. “Universities and research centers across Europe contributed to the development and validation of the four new post-quantum algorithms. The standard may come from the U.S., but the process is truly international.”
However, Luis Jiménez pointed out critical gaps in implementation, especially in constrained devices such as smart cards and cryptographic tokens:
“These devices have limited computing capacity, and post-quantum algorithms expand data significantly. Very few are addressing how to bring post-quantum security to this type of hardware — and that’s a major concern.”
He also underlined that many organizations are dependent on the market’s readiness: “We’re tied to what commercial providers offer. The IETF and software developers must accelerate their work so that solutions can reach us.”
Overcoming “Crypto-Procrastination”
Picking up on the term coined by Gómez — crypto-procrastination — Itan Barmes, formerly Global Quantum Risk Leader at Deloitte, explained that inaction is often not due to negligence but complexity.
“Cryptography has always been there, invisible,” Barmes said. “Now we’re asking companies to migrate everything without even knowing where their cryptography is — that’s almost impossible.”
He stressed the need to lower the barriers for organizations, both technically and procedurally. Regulatory frameworks such as DORA (the EU’s Digital Operational Resilience Act), he argued, represent a good start because they bring crypto-governance into compliance discussions — even if they don’t yet explicitly mention quantum risks.
“DORA is the first step,” Barmes said. “But if we only comply with the minimum requirements, we’ll fail. The goal must be to go beyond mere compliance.”
He also warned that without proper cryptographic inventories, migration will remain a guessing game. “Having a perfect crypto inventory is a myth,” he said. “What matters is connecting it with your general asset inventory — otherwise, it’s meaningless.”
Legal Obligations and Practical Readiness
Luis added that the regulatory clock is already ticking. Under frameworks like NIS2, DORA, and national cybersecurity directives, many critical service providers are legally required to prepare migration plans.
“We already have legal obligations to act,” he said. “I know I must build an inventory, assess where the greatest risks lie, and plan accordingly — even if I can’t yet say exactly when we’ll be ready.”
Jaime agreed, noting that deadlines around 2030 may seem distant but are deceptive. “We can’t wait for the regulations to force us,” he said. “Complexity shouldn’t be an excuse for doing the bare minimum.”
“The best way to prepare,” he concluded, “is to start now and learn while doing — because those who wait will be left behind.”
Beyond Compliance: Building Real Resilience
As the session closed, Carlos Abellan summarized the consensus: the post-quantum transition is not only a technological challenge but also a governance one.
“Complexity drives organizations to do the minimum possible,” he reflected. “But is the minimum ever enough for security?”
Luis offered a clear answer:
“Excellence in cryptography — from algorithms to entropy — is not optional. It’s the foundation of trust.”
The panel ended with a shared message: quantum readiness must begin now, combining standards, regulation, innovation, and collaboration. The marathon has already started — and in the race for post-quantum security, those who move first will define the standards for everyone else.
