lee.potok@thal…
Thu, 11/12/2026 – 10:30
Crypto agility helps organizations reduce security costs, accelerate encryption updates, and prepare for post-quantum threats. Discover how policy-based data protection enables faster security changes without disrupting development or business operations.
Data Security
Encryption
Encryption Key Management
Key Management
Karen Kelvie | Product Marketing, Data Protection
More About This Author >
Every hour developers spend changing an application to accommodate data security is an hour they aren't building products that generate profit. As businesses race to bring AI-powered products to market, pulling developers away from product development becomes increasingly expensive.
Security requirements keep changing, making security updates an ongoing operating expense.
Over time, the business pays repeatedly: through postponed revenue-generating work and the recurring expense of security updates.
The cost extends beyond Development. Test must validate the changes, and IT must deploy the revised code to Production. Every security update consumes resources that could be working on revenue-generating projects.
What is crypto agility?
Crypto agility (also called cryptographic agility) is the ability to replace cryptographic algorithms, keys and parameters in applications and infrastructure without rewriting code or disrupting operations. In data protection, a crypto-agile platform lets a Data Security Admin change an encryption cipher or rotate keys through centrally managed policy, so a security update becomes an administrative task instead of a development project.
The cost of security updates depends on how they're made: in code or by policy
When calculating the cost of security updates, it comes down to which strategy you use. This is a moment to review your options apart from sunk costs.
If your data protection solution requires security updates to be made in code, then you have the scenario described above, and each of your security updates may lag as long as two years while you wait for Development, Test and IT to become available and make your project their top priority. Once they start on your security update, the writing, testing and deployment of updated code will take a minimum of two months. This is the scenario you hope applies to your competitors.
If your data protection solution is a centrally managed, policy-based, crypto-agile platform, the timeline for security updates changes dramatically in your favor. Development, Test and IT are unaffected, so their schedules are no longer dependencies and you avoid the corresponding recurring costs. A Data Security Admin can update your security in real time, potentially in less than two minutes.
According to the 2026 Thales Data Threat Report (p. 4), 53% of organizations are funding AI security from their existing security budgets. As security requirements expand, organizations have even more reason to eliminate unnecessary recurring costs.
Security updates are an ongoing requirement. When you choose your solution you are choosing whether the pain of security updates will be ongoing.
Crypto agility reduces security costs and exposure
Without interrupting business operations, crypto agility enables data security updates to take effect immediately, closing cryptographic security gaps in real time. Instead of requiring a Development team to install the updates, a crypto agile solution enables a Data Security Admin to change an encryption cipher or rotate encryption keys from a simple dropdown menu.
NIST's Considerations for Achieving Crypto Agility: Strategies and Practices (CSWP 39, updated June 2026, p. 2) describes the goal for computing systems: "In a system, crypto agility is the ability to adopt new cryptographic algorithms and stop the use of vulnerable algorithms in applications without disrupting the running system."
As computing advances, vulnerabilities emerge, and security requirements evolve, cryptography must change. NIST notes that each traditional cryptographic transition "is costly, takes time, raises interoperability issues, and disrupts operations."
Crypto agile data protection can shrink recurring costs, remove the need for developers to be involved in security updates, and reduce the lag between identifying and implementing a required security update from a minimum of two months to potentially less than two minutes.
Post-quantum cryptography (PQC) relies on crypto agility to get ahead of Q-Day
For data protection, crypto agility reduces the cost and delay of security updates. For communication protocols such as TLS, crypto
[…]
Content was trimmed to protect the source. Please visit the original article for the full text.
Read the original article:
Crypto Agility: Every Security Change Competes with Business Profits