# Is Atsign's Zero-Rewrite PQC SDK Update the Shortcut Enterprises Actually Need?

Atsign has embedded NIST-approved [post-quantum cryptography](https://quantumintel.tech/glossary/algorithmic-qubits) algorithms directly into its core SDKs — and the company claims developers can get quantum-safe data flows without rewriting existing applications. The announcement, made August 27, 2026, covers three distinct migration scenarios: new application builds, modernization of existing apps, and protection of legacy systems that cannot be modified, the last addressed through Atsign's NoPorts service. All development work is publicly accessible via GitHub.

The operational threat driving this update is not a future quantum computer — it is happening now. "Harvest now, decrypt later" (HNDL) attacks allow adversaries to capture encrypted data today and hold it until sufficiently powerful quantum hardware exists to break the underlying asymmetric cryptography. Quantum computers capable of breaking current public-key schemes — covering digital signatures, digital identity, and key exchange — are widely expected to emerge by the early 2030s, according to the company's announcement. That window converts a theoretical risk into an active operational one for any data that must remain confidential beyond that horizon.

[Google Quantum AI](https://quantumintel.tech/companies/google-quantum-ai) has publicly set a 2029 internal deadline for its own cryptographic transition, a benchmark Atsign cites as context for the urgency of the broader enterprise migration challenge.

---

## What the SDK Update Actually Covers

Atsign's integration targets three use cases, each with a different migration profile:

**New applications** can be built directly on the updated SDKs using traditional development workflows or Atsign's visual development tool, AI Architect. Post-quantum protection is, per the company, on by default.

**Existing applications** can be modernized by integrating the updated SDKs into relevant data flows, again via traditional development or AI Architect. This path requires some integration work but stops short of a full application rewrite — the key commercial claim.

**Legacy systems** that cannot be touched at the code level are addressed through NoPorts. This service provides authenticated, end-to-end encrypted access to existing services without exposed inbound ports and without modifying the underlying application. With the new SDK update, those NoPorts connections now carry post-quantum protection, meaning the data flow to a legacy system can be quantum-safe even when the system itself is not.

That last capability is analytically significant. The enterprise PQC migration problem is not primarily about greenfield development — it is about the vast installed base of systems where code changes are operationally or contractually prohibited. NoPorts functioning as a quantum-safe tunnel around immovable legacy infrastructure addresses a real and underserved segment of that challenge.

---

## What the CEO Said — and What It Means

Aparna Rayasam, CEO of Atsign, stated: "At its core, this integration makes anything built on our platform quantum-safe by default. Achieving post-quantum readiness shouldn't require multi-year application overhauls. By embedding NIST-approved algorithms directly into our SDKs, we're delivering true crypto agility so engineering teams can focus on innovation rather than complex cryptographic mechanics."

The phrase "crypto agility" is worth unpacking. It refers to the architectural ability to swap cryptographic algorithms without restructuring the systems that depend on them — a property that NIST and CISA have both flagged as essential for organizations navigating a transition period where both classical and post-quantum algorithms may need to coexist. Embedding this at the SDK layer, rather than requiring each application team to implement it independently, is a reasonable architectural approach.

Rick Deacon, Head of Platform at NeuroVitals — a mental wellbeing company and Atsign customer — offered a practical enterprise perspective: "Built-in post-quantum security will remove a significant burden for our development and security teams. What we really want to focus on is delivering and securing new capabilities for our customers, and this means we can do just that."

---

## The Skeptical Read

This announcement is a single-source press release, and several questions remain unanswered by the source material.

First, **which specific NIST-approved algorithms** are embedded is not specified in the announcement. NIST finalized its first set of post-quantum standards — including ML-KEM (CRYSTALS-Kyber) and ML-DSA (CRYSTALS-Dilithium) — and the choice of algorithm suite matters for interoperability assessments. Enterprises evaluating Atsign's SDKs should request this detail before deployment decisions.

Second, **independent cryptographic audits** are not mentioned. SDK-level PQC implementations introduce their own attack surface — side-channel vulnerabilities, incorrect parameter choices, and hybrid classical/PQC handshake issues are all documented failure modes in early PQC deployments. The fact that development is public on GitHub supports community review, but that is not equivalent to a formal audit.

Third, the "zero-code-rewrite" claim requires scrutiny. For new and greenfield applications, the claim is plausible. For existing application modernization, SDK integration does involve engineering work — the framing minimizes rather than eliminates that effort. The NoPorts legacy path is the cleanest "no code change" offer, but it introduces a network proxy dependency that some security teams will want to evaluate independently.

---

## Industry Trajectory

The broader context is a migration cycle that security analysts have compared to Y2K in scope, though with a longer and less fixed deadline. Unlike Y2K, the HNDL threat means the damage from inaction can accumulate before the cryptographic break date arrives. That asymmetry — present risk, future capability — is what gives PQC migration its urgency and complexity.

SDK-layer PQC integration from platform providers like Atsign represents one of several architectural approaches the industry is taking. Enterprises managing large, heterogeneous application portfolios will likely need multiple strategies simultaneously: SDK updates for actively maintained code, network-layer tunneling for legacy systems, and hardware security module updates for key management infrastructure. No single vendor offering covers the full stack.

The open-source nature of Atsign's implementation is a differentiator worth noting — it allows enterprise security teams and independent researchers to inspect the cryptographic integration rather than rely solely on vendor attestation.

---

## Key Takeaways

- Atsign has integrated NIST-approved PQC algorithms into its core SDKs as of August 27, 2026, covering new builds, existing app modernization, and legacy system protection via NoPorts.
- The HNDL threat makes PQC migration an active operational concern, not just a future planning item — adversaries are capturing encrypted data now for future decryption.
- Quantum computers capable of breaking current asymmetric cryptography are widely expected by the early 2030s; Google has set a 2029 internal transition deadline.
- The "zero-code-rewrite" claim is strongest for legacy systems using NoPorts and weakest for existing application modernization, which still requires SDK integration work.
- Specific algorithm choices and independent audit status are not disclosed in the announcement — enterprises should request both before deployment.
- All development work is publicly available via GitHub, supporting community-level cryptographic review.

---

## Frequently Asked Questions

**What is "harvest now, decrypt later" and why does it matter for PQC?**
HNDL describes adversaries capturing encrypted data today and storing it until quantum computers powerful enough to break classical asymmetric encryption become available. It converts a future cryptographic threat into a present data security risk, because sensitive data encrypted today may still be valuable when quantum hardware reaches the necessary capability threshold — widely projected for the early 2030s.

**What NIST-approved post-quantum algorithms has Atsign implemented?**
The source announcement does not specify which NIST-approved algorithms are embedded in the SDK update. Enterprises evaluating the platform should request this information directly from Atsign. NIST's finalized standards include ML-KEM and ML-DSA, among others.

**Does the "zero-code-rewrite" claim hold for legacy systems?**
For legacy systems that cannot be modified, Atsign's NoPorts service provides the closest approximation to a no-code-change path — it applies post-quantum protection to network connections without touching the underlying application. Existing applications that can be modified still require SDK integration work, which the announcement frames as less than a full rewrite but does involve engineering effort.

**How does Atsign's approach compare to other enterprise PQC migration strategies?**
SDK-level integration is one of several approaches, alongside network-layer PQC proxies, hardware security module upgrades, and cloud provider-managed key services. Large enterprises will typically require multiple strategies for different segments of their application and infrastructure portfolio. No single vendor solution covers the complete migration surface.

**Is Atsign's PQC implementation independently audited?**
The source announcement does not mention a formal third-party cryptographic audit. The company does make its implementation publicly available on GitHub, which supports community review. Enterprises with high-assurance security requirements should verify audit status directly with the vendor before relying on the implementation for sensitive workloads.