Veilnet
Impact

What the transition costs, and what it gives back

The textbook route to post-quantum is a decade of construction. An overlay is software, and it replaces enough of what you already pay for each month to show up in this year's budget, well before any deadline.

01 — Why it costs so much

The upgrade is
the hard part

The textbook fix is QKD: dedicated fibre, trusted relay nodes every hundred kilometres, new hardware at every hop.

Optical / QKD route
New fibre

Dedicated fibre, trusted relay nodes, new hardware at every hop.

Timeline
A decade

Civil works and certification, against deadlines starting in 2030.

Reach
Fibre only

No answer for radio, satellite, serial links, or anything that moves.

VeilNet route
Software

The cryptography does the work, on the network you already have.

And that assumes
every weak point gets found

A typical estate encrypts in a dozen places, each with its own keys and certificates. Every one of them has to be found, funded, upgraded and re-certified.

Fig. 02a — Today12 upgrade projects
TLS · IPSEC · SSH · VPN · MQTT · SERIAL12 KEY STORES · 12 DIALECTS

Each red square is its own budget line and vendor conversation.

Fig. 02b — With VeilNetSame estate
TLS · IPSEC · SSH · VPN · MQTT · SERIALVEILNETML-KEM + ML-DSA · ONE UPGRADE POINTTHE SAME 12 SYSTEMS · NONE OF THEM UPGRADED

The overlay carries the protection. Nothing underneath has to change.

02 — The impact

The impact starts now, not in 2030

Most organisations call us about the transition, but it isn't the only reason to move now. The same overlay cuts costs you're already paying every month.

Fig. 08 — Time to a protected pathYears vs weeks
Device by deviceSERIAL STEPSDISCOVERPROCUREDEPLOY + TESTRECERTIFYOne overlayONE INSTALLROLL OUT AT ANY PACEPROTECTED PATH LIVESTARTYEAR 1YEAR 2YEAR 3YEAR 4
Swipe to see the full chart

Illustrative only. A device-by-device programme runs one project after another, while an overlay is installed once.

Fig. 09 — What comes out of the rackBefore PQC even enters the room
Cloudflare Tunnel
Ingress · TCP-first
Tailscale
Mesh · vendor control plane
Twingate
Access · per seat
VPN concentrators
Hardware · licensed
Service-mesh sidecars
One per workload
Bastions + cert rotation
On-call burden
Six renewal cycles · six audit trails
Replaced by
One overlay, one identity system, one audit trail

Six product categories, six renewal cycles and six sets of runbooks become one system your team already understands. The saving lands this financial year, and post-quantum protection comes with it.

Fig. 10 — Two ways to reach complianceShape, not scale
START203020350$$$Replace every deviceAUDIT · PROCURE · SWAP · RECERTIFYOverlay the networkINSTALL ONCE · UPGRADE CENTRALLYCOMPLIANT HERE
Swipe to see the full chart
One upgrade, not hundreds

When the algorithms change again, and they will, you update the overlay. You don't reopen a hundred procurement conversations.

Fewer moving parts, today

VPN concentrators, bastion hosts, tunnel daemons, mesh sidecars and all their certificate rotation do a job the overlay already does. Retiring them saves money this year.

Security, not a subscription

Per-seat network pricing grows with you forever. Owning your root of trust doesn't.

The equipment stays

Equipment you've already paid for stays in service. Systems that can't be made post-quantum don't need to be.

Find out what this costs to run

The assessment shows what can be upgraded, what can't, and what each route costs to run. The report is yours either way.

Request an evaluationSee how it works