Your systems can prove the credential was used.
They cannot prove that you used it.
Everything we build lives in that gap.Kolm Shield secures data in transit and at rest against today’s attackers and tomorrow’s quantum computers, and answers the question a valid credential cannot: whether the hands using it are the ones it was issued to.
- Protects
- Data in transit and at rest
- Standards
- NIST FIPS 203 · 204 · 205
- First sector
- Financial services
- Status
- Patent pending, PCT filed
The attack looks legitimate.
A stolen credential does not produce a suspicious instruction. It produces a correctly signed one, and every check you own approves it, correctly.
Post-quantum migration ensures a signature cannot be forged. It does nothing about a signature made with a real key, in the wrong hands.
The attack is prepared in the interval no control measures.
Post-quantum migration, access control and incident detection are each necessary, and each answers its own question well. What none of them measures is the interval in which an attack is prepared: a valid credential, in the wrong hands, on a channel that is cryptographically sound, often weeks before anyone classifies an incident.
Can this signature or session be broken?
Not once it is migrated, including by a future quantum computer. It says nothing about who holds the key.
Is this credential valid?
Yes, and that is the difficulty: a stolen credential is a valid one, and every check approves it, correctly.
Has an incident occurred?
Usually answered after the act. The weeks before it are the interval disclosures and controls were never designed to count.
Is an attack being prepared, and are these the hands the credential was issued to?
Answered before the act, with the reasons attached, on cryptography built to outlast the algorithms in use today.
- Beside the path, by default.It advises and your systems decide. It can be removed at any stage.
- Warnings with their working.Reviewable by your team, your auditors and your regulator.
- Built for the failure mode.The whole of financial services first; the same two acts everywhere else.
The calendar is set by other people.
The window to move early is the current procurement cycle, not the next one. The institutions that migrate last will be the ones whose archives were worth taking first.
The thinking is public. The build is not.
The Uncounted
Two measured categories of loss, and a third that neither captures. Four South African cases from the public record, read as one pattern.
Next, from NovemberBefore It Becomes Materiala newsletter for boards
- IThe three weeks nobody countsDwell time, and the interval financial-sector controls and disclosures were never designed to measure.Read →
- IIOne provider, many perimetersThird-party concentration, and why an institution’s own controls cannot see the environment that now holds its clients’ data.Read →
- IIIThe request that looked legitimateTrusted channels, and what happens when a process is followed correctly and the request itself is fraudulent.Read →
- IVIdentity at the sourceWhat happens to onboarding checks once the documents they depend on are themselves in circulation.19 Oct
We would rather be tested early than admired late.
Request a briefing →briefing@kolmshield.com
Briefings, and our security and compliance documentation, are shared under mutual non-disclosure. Investors and candidates: see Company.