Skip to content

Resources

Read the work. Check every number.

AgilePQ’s white papers and announcements, and the standards, laws, threat reports and research behind the figures on this site. Each entry links to the document itself.

Primary referencesWhite papers
EVERY SOURCE ON THIS PAGE, BY YEAR52 of 65 since 2024Agile⁠PQ8Standards8Guidance8Law5Threats21Research16Market7earlier2014201820222026
One dot per source listed below, placed by the year it was published. The threat picture is recent.

01White papers

The white papers. As published.

Four papers AgilePQ wrote between 2019 and 2021, each dated on its first page. They are kept as an archive: their figures, sources and wording are of their time and have not been updated. The current figures, each with its source, are on this site.

Position paperDated 14 May 20215 pages · 550 KB

Colonial Pipeline Co. Ransomware Attack

The May 2021 ransomware attack that shut down Colonial Pipeline, and what it says about operational technology networks.

Open the PDF

White paperDated 31 January 20205 pages · 524 KB

SLiM Security for Cellular, Satellite, and Constrained Networks

Why TLS struggles on constrained cellular, satellite and low-power links, and how SLiM is delivered as a SIM applet or a firmware library.

Open the PDF

White paperDated Q3 201913 pages · 506 KB

A Guide to Post-Quantum Security for IoT Devices

What a large quantum computer would mean for the public-key cryptography in use today, and why the lifetime of data matters for IoT.

Open the PDF

White paperDated 29 August 20198 pages · 368 KB

Consequences and Risks of Security Breaches from Internet of Things (IoT) Devices

Seven common misconceptions about IoT security, and what breaches through connected devices have cost.

Open the PDF

Archive. The papers are reproduced exactly as AgilePQ issued them. Where a paper and this site differ, this site, with its sources, is current.

02Announcements

News, dated and sourced.

What AgilePQ has announced, dated, with the source for each.

  1. 12Sep 2018

    Endpoint security with iBoT

    AgilePQ and iBoT announce security work for Class 0 and Class 1 endpoints.

    Press release · GlobeNewswire

    Read the release

  2. 27Sep 2018

    AgilePQ announces SLiM

    Data-in-transit security for constrained IoT endpoints.

    Press release · GlobeNewswire

    Read the release

  3. 18Feb 2020

    Partnership with Aegex Technologies

    AgilePQ and Aegex Technologies announce a partnership.

    Aegex news

    Read the release

  4. 11Mar 2020

    AgilePQ acquires Centri

    The acquisition of Centri, an IoT security company.

    AgilePQ press release, archived

    Ask for a copy

03Primary references

The sources. Straight from the publisher.

The standards, government guidance, laws, threat reports and research this site relies on, grouped. Every outside figure on these pages traces to one of them, and each links to the publisher’s own document.

Standards

8 documents

Government guidance

8 documents

Law

5 documents

Threat reporting

21 documents

Research and industry

16 documents

Market and devices

7 documents

04Press

Writing about AgilePQ?

Ask for anything on this page: a source, a figure, a date, a paper. Press questions and interview requests go to AgilePQ directly.

Press inquiriesinfo@agilepq.com

05Sources

Sources and notes73 sources · 5 from AgilePQ’s own records
  1. 1AgilePQ position paper “Colonial Pipeline Co. Ransomware Attack”, dated “MAY 14, 2021” on its first page; 5 pages.AgilePQ (PDF, reproduced as published).AgilePQ record
  2. 2AgilePQ white paper “SLiM Security for Cellular, Satellite, and Constrained Networks”, dated “January 31, 2020” on its first page; 5 pages.AgilePQ (PDF, reproduced as published).AgilePQ record
  3. 3AgilePQ white paper “A Guide to Post-Quantum Security for IoT Devices”, dated “Q3 2019” on its first page; 13 pages.AgilePQ (PDF, reproduced as published).AgilePQ record
  4. 4AgilePQ white paper “Consequences and Risks of Security Breaches from Internet of Things (IoT) Devices”, dated “August 29, 2019” on its first page; 8 pages.AgilePQ (PDF, reproduced as published).AgilePQ record
  5. 5AgilePQ and iBoT announced Class 0/1 endpoint security work on 12 September 2018.AgilePQ press release, GlobeNewswire.Sourced
  6. 6AgilePQ announced SLiM, data-in-transit security for constrained IoT endpoints, on 27 September 2018.AgilePQ press release, GlobeNewswire.Sourced
  7. 7AgilePQ and Aegex Technologies announced a partnership on 18 February 2020.Aegex news (18 February 2020).Sourced
  8. 8AgilePQ announced its acquisition of Centri, an IoT security company, on 11 March 2020.AgilePQ press release (11 March 2020, agilepq.com archive).AgilePQ record
  9. 9RFC 7228 sets Class 0 at much less than 10 KiB of RAM and 100 KiB of code, Class 1 at about 10 KiB and 100 KiB, and Class 2 at about 50 KiB and 250 KiB.IETF RFC 7228, Terminology for Constrained-Node Networks, section 3, Table 1 (May 2014).Sourced
  10. 10NIST’s IoT device baseline includes “the ability to use demonstrably secure cryptographic modules for standardized cryptographic algorithms”.NIST IR 8259A, IoT Device Cybersecurity Capability Core Baseline (May 2020).Sourced
  11. 11IETF RFC 9528 (March 2024): EDHOC is “a very compact and lightweight authenticated Diffie-Hellman key exchange with ephemeral keys”; its example messages total 101 to 242 bytes. Diffie-Hellman over elliptic curves is a public-key method.IETF RFC 9528, Ephemeral Diffie-Hellman Over COSE (EDHOC).Sourced
  12. 12NIST approved its first three post-quantum standards in August 2024: FIPS 203 (ML-KEM, key establishment), FIPS 204 (ML-DSA, signatures) and FIPS 205 (SLH-DSA, hash-based signatures). They are public-key algorithms.Federal Register 2024-17956 (effective 14 August 2024).Sourced
  13. 13NIST’s draft transition plan marks RSA and elliptic-curve algorithms at 112-bit strength “Deprecated after 2030” and quantum-vulnerable public-key algorithms “Disallowed after 2035”. It is still an initial public draft.NIST IR 8547 ipd, Transition to Post-Quantum Cryptography Standards (12 November 2024).Sourced
  14. 14NIST: “In a DATA POISONING attack, an adversary controls a subset of the training data by either inserting or modifying training samples.”NIST AI 100-2 E2025, Adversarial Machine Learning, section 2.1.1 (24 March 2025).Sourced
  15. 15NIST SP 800-232 standardizes the Ascon family (Ascon-AEAD128, Ascon-Hash256, Ascon-XOF128, Ascon-CXOF128) for constrained devices, “a viable alternative when the Advanced Encryption Standard (AES) may not perform optimally”.NIST SP 800-232, final (13 August 2025).Sourced
  16. 16NIST’s Cryptographic Module Validation Program: “The correct the term is validated” — a vendor calling a product “compliant” only “believes” it meets the requirements, “but the product has not gone through the CMVP validation process.”NIST CMVP FAQ, SG-7 and P-18 (updated 21 August 2026).Sourced
  17. 17National Security Memorandum 10 sets the goal “of mitigating as much of the quantum risk as is feasible by 2035”.NSM-10 (4 May 2022), via govinfo.Sourced
  18. 18NSA CNSA 2.0: “Niche equipment (e.g., constrained devices, large public-key infrastructure systems): support and prefer CNSA 2.0 by 2030, and exclusively use CNSA 2.0 by 2033.” “NSA expects the transition to QR algorithms for NSS to be complete by 2035.”NSA, Announcing the Commercial National Security Algorithm Suite 2.0 (September 2022).Sourced
  19. 19CISA, NSA and NIST: “cyber actors could target our nation’s most sensitive information now and leverage future quantum computing technology”, a threat “particularly devastating to sensitive information with long-term secrecy requirements”.NSA press release on the joint Quantum-Readiness fact sheet (21 August 2023).Sourced
  20. 20The White House: the cost of migrating prioritized federal information systems to post-quantum cryptography “between 2025 and 2035 will be approximately $7.1 billion in 2024 dollars”; replacing systems with cryptography hardwired into hardware or firmware is “a significant portion of the overall estimate”.Report on Post-Quantum Cryptography (July 2024); excludes national security systems.Sourced
  21. 21NSA: “by January 1, 2027, all new acquisitions for NSS will be required to be CNSA 2.0 compliant unless otherwise noted”; symmetric encryption is AES with “256-bit keys for all classification levels”.NSA, CNSA 2.0 FAQ v2.1 (December 2024).Sourced
  22. 22UK NCSC milestones: by 2028 define migration goals and plan; by 2031 complete the highest-priority migrations; by 2035 “Complete migration to PQC of all your systems, services and products”.NCSC, PQC migration timelines (20 March 2025).Sourced
  23. 23EU roadmap: “By 31.12.2026: At least the First Steps have been implemented by all Member States”; by 31.12.2030 the transition for high-risk use cases is completed; by 2035 medium-risk is completed and low-risk completed as far as feasible.Coordinated Implementation Roadmap for the transition to Post-Quantum Cryptography, v1.1 (June 2025).Sourced
  24. 24European Commission: “‘Store now, decrypt later’ attacks are already likely occurring.”European Commission, Post-Quantum Cryptography policy page (June 2025).Sourced
  25. 25U.S. classified information is marked for declassification after 10 years, or up to 25 years when its sensitivity requires it.Executive Order 13526, section 1.5(b).Sourced
  26. 26The UK’s Product Security and Telecommunications Infrastructure regulations “come into force on 29th April 2024”.The Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023, SI 2023/1007.Sourced
  27. 27EU Cyber Resilience Act: applies from 11 December 2027, with reporting of actively exploited vulnerabilities from 11 September 2026. Products must “protect the confidentiality of stored, transmitted or otherwise processed data … such as by encrypting relevant data at rest or in transit by state of the art mechanisms”. Fines reach EUR 15 000 000 or 2.5% of worldwide annual turnover, whichever is higher.Regulation (EU) 2024/2847, Article 71(2), Annex I Part I (2)(e), Article 64(2).Sourced
  28. 28The EU Radio Equipment Directive cybersecurity requirements (Delegated Regulation (EU) 2022/30) apply from 1 August 2025, with harmonised standards EN 18031-1, -2 and -3.Commission Implementing Decision (EU) 2025/138 (28 January 2025).Sourced
  29. 29Executive Order 14412 directs agencies to “transition all HVAs and high impact systems to use PQC for key establishment by December 31, 2030” and for digital signatures by 31 December 2031, and calls for a rule requiring covered contractors “to comply by December 31, 2030, with NIST’s FIPS, including all applicable FIPS incorporating PQC compliant algorithms.”Executive Order 14412, Securing the Nation Against Advanced Cryptographic Attacks (22 June 2026; Federal Register 2026-12909).Sourced
  30. 30Colonial Pipeline’s CEO testified that after the May 2021 ransomware attack “all 5,500 miles of pipelines had been shut down”; the line “accounts for nearly half of the fuel consumed on the East Coast”.Joseph Blount, testimony to the US Senate Homeland Security Committee (8 June 2021).Sourced
  31. 31CISA, NSA and FBI: Volt Typhoon is “pre-positioning themselves on IT networks to enable the disruption of OT functions across multiple critical infrastructure sectors”, with access maintained in some environments “for at least five years”, using “end-of-life SOHO routers”.CISA advisory AA24-038A (7 February 2024).Sourced
  32. 32CISA: “The actors compromised at least 75 devices, including at least 34 in the WWS [water and wastewater] Sector in the United States.”CISA advisory AA23-335A (updated December 2024).Sourced
  33. 33US and allied agencies: Salt Typhoon targeted “telecommunications, government, transportation, lodging, and military infrastructure networks globally”.NSA, joint advisory AA25-239A (27 August 2025).Sourced
  34. 34The Cyber Monitoring Centre estimated the Jaguar Land Rover incident at £1.9 billion, affecting more than 5,000 UK organizations: “the most economically damaging cyber event to hit the UK”. “Vehicle production was suspended for approximately five weeks.”Cyber Monitoring Centre statement (22 October 2025).Sourced
  35. 35Anthropic: “the threat actor was able to use AI to perform 80-90% of the campaign, with human intervention required only sporadically”.Anthropic, Disrupting the first reported AI-orchestrated cyber espionage campaign (13 November 2025).Sourced
  36. 36Anthropic: “Highly cyber-capable AI models are widely available to attackers now.” “But defensive tools—including our own—have not yet reached enough of the defenders who need them.”Anthropic, Introducing the Anthropic Cyber Mission (8 October 2026).Sourced
  37. 37Anthropic: “Our experiments suggest that small AI models may be months away from being capable enough to self-replicate” on commercial internet-of-things devices. “If small models improve at their historical rate, they’ll match this capability level by the end of this year.” Home and small-business devices may be the first targets “because they’re connected to the internet and, historically, have had minimal security measures in place.”Anthropic, AI models may be capable of self-replicating without access to a datacenter (12 October 2026).Sourced
  38. 38Cloudflare estimated the Aisuru botnet at “an estimated 1–4 million infected hosts globally”.Cloudflare DDoS threat report, 2025 Q3 (3 December 2025).Sourced
  39. 39CERT Polska: attacks on more than 30 wind and solar farms and a heat plant serving almost 500,000 customers; “All attacks had a purely destructive objective.”CERT Polska incident report (30 January 2026).Sourced
  40. 40CrowdStrike: “The average eCrime breakout time fell to just 29 minutes in 2025”, the fastest observed was 27 seconds, and “AI-enabled adversaries increased operations by 89% year-over-year”.CrowdStrike 2026 Global Threat Report (24 February 2026).Sourced
  41. 41FBI, CISA and partners: attackers manipulated “data displayed on human machine interface (HMI) and supervisory control and data acquisition (SCADA) displays”; in an update, “the changes disabled critical shutdown and alarm logic … allowing systems to enter unsafe conditions without notifying operators”.Joint advisory AA26-097A (7 April 2026) and its update (22 July 2026).Sourced
  42. 42Minnesota IT Services: attackers “targeted operational technology at more than 30 Minnesota community water systems” on 26–27 July 2026.Minnesota IT Services (28 July 2026).Sourced
  43. 43IBM gives “the global breach average of $4.99 million”. It reports that “Only 37% of breached organizations stated that they encrypt sensitive data both at rest and in transit” and that “Most AI-driven attacks reported in the study targeted critical infrastructure sectors (62%)”.IBM, Cost of a Data Breach Report 2026 (29 July 2026; 602 organizations, breaches March 2025–February 2026).Sourced
  44. 44FBI, CISA and partners warned of actors “using AI-generated exploitation scripts disguised as legitimate monitoring tools” against industrial controllers.Joint advisory AA26-231A (August 2026).Sourced
  45. 45FBI: “The BADBOX 2.0 botnet consists of millions of infected devices”, among them “TV streaming devices, digital projectors, aftermarket vehicle infotainment systems, digital picture frames and other products”; criminals work by “configuring the product with malicious software prior to the users purchase” or during set-up. Google: “The Badbox 2.0 botnet compromised over 10 million uncertified devices”.FBI public service announcement I-060525-PSA (5 June 2025); Google (17 July 2025).Sourced
  46. 46US Department of Justice: “Since at least 2024, GRU actors have exploited known vulnerabilities to steal credentials for thousands of TP-Link routers worldwide.” The FBI said the GRU “weaponized routers owned by unsuspecting Americans in more than 23 states” to steal sensitive information. A court-authorized operation disrupted the network.US Department of Justice, Office of Public Affairs (7 April 2026).Sourced
  47. 47Cloudflare: “In 2025, we mitigated a 31.4 Tbps DDoS attack lasting 35 seconds. The source was the Aisuru-Kimwolf botnet, including many infected Android TVs.” Its Q4 2025 report: “The botnet comprises an estimated 1-4 million infected hosts.”Cloudflare (10 April 2026); Cloudflare 2025 Q4 DDoS threat report (5 February 2026).Sourced
  48. 48CISA: “In July 2026, CISA observed malicious cyber activity targeting internet-exposed systems at more than 100 Water and Wastewater Systems (WWS) Sector entities, commonly via programmable logic controllers (PLCs) connected directly to a cellular modem.” “Threat actors targeting exposed PLCs have modified passwords to lock out operators … This activity has resulted in boil water notices and sustained manual operations.”CISA, Internet Exposure Reduction Guidance; CISA alert (30 July 2026).Sourced
  49. 49CERT Polska: at a smaller combined heat and power plant “supplying heat to 50,000 residents”, “a steam turbine and the water treatment system used to produce process water were shut down”; the attack did not disrupt heat supplies to consumers. “To the best of our knowledge, the use of a private APN to gain access to the OT network was the first instance of this attack vector being observed in a real-world cyberattack.”CERT Polska, follow-up report on the December 2025 energy-sector incident (8 August 2026).Sourced
  50. 50Shadowserver Foundation: “This Special Report contains information about ~296,000 devices compromised by the Dysphoria botnet.” “Dysphoria targets IoT devices and its primary function appears to be for use in DDoS-attacks.”Shadowserver, Dysphoria Botnet Special Report (last updated 13 August 2026).Sourced
  51. 51Kerckhoffs’s principle: a cipher must not depend on secrecy of the design; it should stay secure if everything except the key falls into an adversary’s hands.A. Kerckhoffs, La cryptographie militaire, Journal des sciences militaires (1883).Sourced
  52. 52Data is at risk when x + y > z: x is how long it must stay secret, y is how long migration takes, z is how long until a quantum computer breaks today’s public-key cryptography.M. Mosca, “Cybersecurity in an era with quantum computers: will we be ready?”, IACR ePrint 2015/1075, section 1.Sourced
  53. 53Mirai reached “a peak of 600,000 infections at the end of November 2016”. On 21 October 2016 it attacked Dyn, a DNS provider, disrupting sites including Amazon, GitHub, Netflix, PayPal, Reddit and Twitter.Antonakakis et al., Understanding the Mirai Botnet, USENIX Security 2017.Sourced
  54. 54Gidney and Ekerå estimated that RSA-2048 could be factored in 8 hours with 20 million noisy qubits.C. Gidney, M. Ekerå, How to factor 2048 bit RSA integers in 8 hours using 20 million noisy qubits, arXiv:1905.09749 (2019); Quantum 5, 433 (2021).Sourced
  55. 55Google’s 105-qubit Willow chip demonstrated error correction “below threshold”: “being able to drive errors down while scaling up the number of qubits.”Google (9 December 2024).Sourced
  56. 56Gidney: “a 2048 bit RSA integer could be factored in less than a week by a quantum computer with less than a million noisy qubits” (same hardware assumptions as 2019).C. Gidney, arXiv:2505.15917 (21 May 2025).Sourced
  57. 57Global Risk Institute survey of 26 experts: a quantum computer able to factor RSA-2048 in under 24 hours is “quite possible (28-49%) within the next 10 years” and “likely (51-70%) in the next 15”.Global Risk Institute, Quantum Threat Timeline Report (2025 survey, published March 2026).Sourced
  58. 58Google: “We’re setting a timeline for post-quantum cryptography migration to 2029.” “The threat to encryption is relevant today with store-now-decrypt-later attacks.”Google (25 March 2026).Sourced
  59. 59Zscaler (May 2019), from 56 million IoT device transactions over 30 days: “over 90 percent of IoT transactions are occurring over a plain text channel”.Zscaler press release (22 May 2019).Sourced
  60. 60Zscaler ThreatLabz: “62.1% of IoT transactions now use TLS/SSL encryption, far more than the 17% in our previous report.” The remaining 37.9% did not use TLS; that subtraction is AgilePQ’s. The data is enterprise traffic through Zscaler’s cloud.Zscaler ThreatLabz, 2023 Enterprise IoT and OT Threat Report (October 2023).Sourced
  61. 61Microsoft: “78% of industrial network devices on customer networks monitored by Microsoft Defender for IoT have known vulnerabilities.” “Among these, 46% utilize deprecated firmware, for which patches are no longer available, while the remaining 32% operate outdated systems with unpatched vulnerabilities.”Microsoft Security blog (30 May 2024), citing the Microsoft Digital Defense Report 2023.Sourced
  62. 62Palo Alto Networks, from “over 27 million connected devices belonging to 1,803 enterprise network customers”: “A full 32.5% of all devices in corporate networks operate outside IT control.” “nearly 39% of IT devices registered in Active Directory lack an active EDR or XDR.”Palo Alto Networks, 2025 Device Security Threat Report blog (28 October 2025).Sourced
  63. 63SANS Institute, from more than 330 industrial cybersecurity professionals: “Only 12.6 percent reported full ICS Cyber Kill Chain visibility”.SANS 2025 State of ICS/OT Security survey, press release (19 November 2025).Sourced
  64. 64Censys: “over 650,000 hosts expose one or more MQTT services”; “Of these, more than 480,000 (approx. 74%) accept unauthenticated connections from any client”. MQTT is a messaging protocol widely used by small connected devices.Censys, Unauthenticated Message Queues are a Problem (6 January 2026).Sourced
  65. 65Dragos: “Dragos estimates that fewer than 10 percent of OT networks worldwide currently have meaningful network monitoring in place.” It is Dragos’s estimate, not a measurement.Dragos, OT Threat Landscape 2026 (24 March 2026), drawing on its 2026 Year in Review.Sourced
  66. 66Honeywell, from a survey of more than 600 industrial cybersecurity leaders: “only 21% reported having a complete inventory of their OT assets”, “while only 20% continuously monitor connected IoT devices such as cameras and sensors”. Honeywell sells OT security services.Honeywell 2026 OT Security Benchmark Report, press release (22 September 2026).Sourced
  67. 67Berg Insight forecasts smart electricity meters in Asia-Pacific to grow “from 857.6 million in 2024 to nearly 1.3 billion in 2030”.Berg Insight, Smart Metering in Asia-Pacific, product sheet (October 2025).Sourced
  68. 68IoT Analytics: connected IoT devices “expected to grow 14% year-over-year to 21.1 billion by the end of 2025” and “estimated to reach 39 billion in 2030”.IoT Analytics, Number of connected IoT devices (28 October 2025).Sourced
  69. 69IoT Analytics: “By the end of 2023, 1.06 billion smart meters (electricity, water and gas) have been installed worldwide”; the installed base “is expected to exceed 1.75 billion by 2030 (CAGR 6%)”.IoT Analytics, smart electricity meter market 2024 (21 February 2024).Sourced
  70. 70Berg Insight: “The global satellite IoT subscriber base grew to surpass 5.8 million in 2024.” Subscribers will grow at a CAGR of 41.1 percent “to reach 32.5 million units in 2029.”Berg Insight, The Satellite IoT Communications Market, 5th edition (September 2025).Sourced
  71. 71LoRa Alliance: “LoRaWAN-connected devices have reached 150 million globally, growing at a rate of 25% CAGR.”LoRa Alliance press release (22 September 2026); the alliance’s own count.Sourced
  72. 72Ericsson: “Total cellular IoT connections reached around 4.5 billion at the end of 2025”, forecast to reach 7.8 billion in 2031.Ericsson Mobility Report, IoT connections outlook (June 2026).Sourced
  73. 73wolfSSL describes its embedded TLS library as having a “minimum footprint size of 20-100 kB, depending on build options and operating environment” and “runtime memory usage between 1-36 kB”.wolfSSL product page (vendor’s own figures), accessed October 2026.Sourced