The post-quantum signature scheme HAWK was withdrawn from consideration and will not be standardized after its security findings were confirmed within 24 hours. This event highlights a shift where AI has drastically reduced the time required to discover cryptographic weaknesses, while the time needed for organizational remediation remains measured in years.
US Executive Order 14412 has accelerated post-quantum migration deadlines to 2030 and 2031. Meanwhile, CISA and NIST are directed to publish guidance on the minimum elements of a cryptographic bill of materials by March 2027 to help organizations manage their security posture.
AI-assisted attackers can now scan code, certificates, and network configurations at near-zero cost, exposing classical flaws in existing systems. Large organizations often struggle to identify where specific algorithms are deployed, with some security leads estimating it could take weeks to locate vulnerable implementations.
To mitigate these risks, organizations are advised to prioritize cryptographic agility. This involves maintaining a comprehensive inventory of cryptographic assets, ensuring algorithms can be replaced without rewriting applications, and mandating that suppliers demonstrate similar capabilities through tested migration plans.
