Integrating Post-Quantum Cryptography (PQC) into your SASE framework with Fortinet and Lumen is a critical defensive posture against the next generation of cyber threats, one designed to protect digital communications for decades. The real value for organizations that adopt this PQC integration now is getting ahead of the problem, securing data preemptively and maintaining compliance as computational power explodes.
Key Takeaways
- You need a PQC migration plan started by 2026, as NIST is nearly finished with its initial round of PQC algorithm standardization.
- For FortiSASE, you’ll need to get into the weeds and tweak VPN and secure web gateway configurations to support PQC-enabled tunnels.
- Lumen’s global network fabric can accelerate PQC-protected traffic which is a big deal for cutting latency for distributed workforces.
- When you test a PQC-integrated SASE solution, you’re mostly just validating that the algorithms negotiate correctly and checking the performance hit under different network loads.
- Adopting PQC within SASE now is your best defense against “harvest now, decrypt later” attacks, protecting sensitive information for the long haul.
1. Understand the Quantum Threat and PQC Field
The entire field of cryptography is shifting because of one thing: the looming threat of large-scale quantum computers. While these machines aren’t fully here yet, they have the potential to shatter the public-key algorithms like RSA and ECC that secure the internet today. This is real. The National Institute of Standards and Technology (NIST) has been working since 2016 to standardize new PQC algorithms to fight this threat. Based on what we’re seeing from NIST, the first PQC standards should be final by late 2026 or early 2027, a timeline that means enterprises must begin PQC transition planning immediately. Ignoring this leaves your sensitive data wide open to “harvest now, decrypt later” attacks, where attackers are already siphoning up encrypted data today, planning to crack it open once their quantum computers are ready.
Pro Tip: Dual-Layered Security
Don’t just flip a switch to PQC-only. For the next few years, the most pragmatic path is a hybrid approach, combining the classical algorithms we trust with these new PQC algorithms. This “hybrid mode” ensures you’re still secure even if some unexpected flaw is found in a PQC candidate, which is a legitimate concern given how new they are. It’s redundant, like wearing a belt and suspenders, but it offers maximum assurance. For example, you could configure a TLS 1.3 connection to use AES-256 for symmetric encryption while also using a PQC algorithm like CRYSTALS-Dilithium for signatures and a PQC key exchange like CRYSTALS-Kyber alongside a classical one like ECDH.
2. Assess Your Current Fortinet SASE Deployment
Before you can integrate PQC, you have to do a full audit of your existing Fortinet SASE architecture. This means finding every single component that uses public-key crypto for secure communications. Fortinet’s FortiSASE platform pulls together a lot of services, SWG, CASB, ZTNA, and FWaaS, and each one, especially anything building a VPN tunnel or securing web traffic, will need PQC support eventually. You need to focus on your FortiClient endpoints and FortiGate appliances, since those are the primary points of cryptographic exchange. Document all your firmware versions, crypto policies, and certificate management processes. A complete inventory is essential for a smooth transition. You have to know exactly what you have before you can start changing it.
Screenshot Description: A dashboard view of a FortiManager instance showing a list of managed FortiGate devices. Highlighted sections indicate firmware versions and VPN tunnel configurations, which are critical for PQC assessment.
Common Mistake: Ignoring Certificate Authorities
So many teams get hyper-focused on the protocols and completely forget about their Public Key Infrastructure (PKI). Your Certificate Authority (CA) has to be PQC-ready, too. If your internal CA can’t issue certificates with PQC algorithms, your SASE gear won’t be able to establish PQC-secured connections, no matter how capable the FortiGates are. You have to plan to either upgrade your own CA or start working with a third-party CA that is already PQC-capable.
3. Configure FortiSASE for PQC Compatibility
Getting PQC actually running on FortiSASE will mostly be a matter of updating firmware and changing cryptographic profiles. Fortinet is expected to release firmware updates with the NIST-selected PQC algorithms around late 2026. Once you get your hands on those, the process will look something like this:
- Firmware Upgrade: Get the latest FortiOS firmware on all your FortiGate devices and the latest FortiClient software on all endpoints. This is required.
- Policy Configuration: Go into the VPN section in FortiManager or on the FortiGate itself. For your IPsec VPNs, you’ll need to create new cryptographic proposals that specify PQC algorithms for the key exchange (e.g., CRYSTALS-Kyber) and digital signatures (e.g., CRYSTALS-Dilithium).
- SSL/TLS Profile Updates: For your web traffic, you’ll need to get into your SSL/TLS inspection profiles and specify your preferred PQC cipher suites. This setting is usually under Security Profiles > SSL/SSH Inspection.
- Certificate Management: Enroll new PQC-compliant certificates for your FortiGates and any internal services. This means generating new certificate signing requests (CSRs) that specify PQC algorithms and getting them signed by your PQC-ready CA.
Screenshot Description: A cropped image of the FortiGate GUI showing the “VPN > IPsec Tunnels > Phase 2 Selectors” configuration page. A new entry is being added, with dropdown menus for “Key Exchange” and “Encryption” algorithms, where PQC options like “CRYSTALS-Kyber” and “Dilithium” would be selectable.
Pro Tip: Staged Rollout for Minimal Disruption
Don’t push PQC configurations to your entire production environment all at once. Start small with a pilot group of users and a single FortiGate you can watch closely. Monitor performance, connectivity, and check the error logs for anything weird. As you get more confident, you can gradually expand the rollout. This staged approach is your safety net. It lets you find and fix problems without taking down the whole company.
“U.S. cybersecurity startups raised $11.5 billion in 2025, the highest since 2022, a recent report by JPMorgan Chase said, citing PitchBook data. AI-enabled companies accounted for about 72% of U.S. cybersecurity venture deals through May this year, compared with 36% in 2019, the report said.”
4. Integrate Lumen’s SASE for Global PQC Acceleration
Lumen’s SASE offering, built on its massive global network, is a key piece for optimizing PQC-secured traffic, especially if your organization is spread all over the map. Their platform connects users, apps, and data over a high-performance network, basically abstracting away all the underlying complexity. When you’re integrating with Lumen, your focus is making sure the PQC-enabled traffic from your Fortinet gear can fly across their network without a hitch. This means:
- Network Edge Configuration: You have to make sure your FortiGate devices or FortiSASE points of presence (PoPs) are correctly peered with Lumen’s SASE PoPs. This usually means setting up secure tunnels (like IPsec or GRE over IPsec) from your Fortinet appliances to the Lumen SASE edge, and those tunnels themselves should be PQC-enabled wherever Lumen’s platform supports it.
- Traffic Steering Policies: In the Lumen SASE management portal, you’ll set up rules to steer PQC-secured traffic efficiently. You might want to prioritize PQC traffic or send it over specific network paths to keep latency down. Lumen’s network intelligence can even do this for you dynamically.
- Performance Monitoring: Use Lumen’s own network monitoring tools to keep an eye on PQC-secured connections. You’re looking for metrics like latency, jitter, and packet loss. PQC algorithms can have bigger keys and signatures, which might add a little overhead, but a high-capacity network like Lumen’s is built to absorb that kind of thing.
A Lumen report from Q3 2025 showed their SASE platform, when used with PQC-enabled endpoints, delivered an average of 15% lower latency on intercontinental secure connections compared to old-school VPNs that didn’t have SASE optimization. That shows the real-world benefit of bringing a strong network provider into your PQC strategy.
Screenshot Description: A conceptual diagram of Lumen’s SASE architecture, showing various global PoPs connected by a high-speed fiber backbone. Arrows illustrate traffic flow from user devices through a FortiSASE PoP, then onto the Lumen network to cloud applications, with a small icon indicating PQC encryption on the network segments.
5. Validate and Monitor PQC Performance
This isn’t a ‘set it and forget it’ task. Rigorous validation and monitoring are continuous steps.
- Functional Testing: First, you have to verify that PQC algorithms are actually being negotiated and used. Is it even working? Tools like Wireshark are perfect for this. You can filter for TLS 1.3 handshakes and dig into the “Cipher Suite” and “Key Exchange” parameters to confirm you see PQC algorithms in use.
- Performance Benchmarking: Get a performance baseline before and after you turn on PQC. You need to measure throughput, latency, and especially the CPU utilization on your FortiGate devices. PQC algorithms are designed to be fast, but some might add a bit of overhead. You have to understand that impact for capacity planning. For instance, one test on a FortiGate 100F running FortiOS 7.6.0 showed a 5-7% jump in CPU load during peak VPN traffic when using CRYSTALS-Kyber for key exchange compared to just ECDH.
- Security Audits: Plan on doing regular security audits to make sure your PQC configurations stay compliant with the standards, because the standards are going to keep evolving. The PQC field is still young, so expect more recommendations and updates from NIST.
- User Experience Monitoring: Most importantly, listen to your users. Are they seeing connectivity problems or slowdowns? The whole point is to add security without killing productivity.
Editorial Aside: The Hidden Cost of Inaction
Many organizations are putting off PQC migration because there’s no “immediate threat.” This thinking is just wrong. The cost of trying to retrofit all your systems later, when you’re under pressure, will be way higher than the cost of planning it out now. Besides, all the data you’re sending today, if it isn’t protected with PQC, could be decrypted in the future. For any company dealing with intellectual property, government data, or financial records that need to stay secret for decades, the damage from a quantum-enabled breach would be catastrophic. Start now. Even a small pilot project is a start. Integrating PQC into SASE architectures from Fortinet and Lumen is an immediate imperative for any organization that wants to secure its digital assets against quantum threats. By carefully planning, configuring, and validating these advanced crypto measures, businesses can gain a real edge in preemptive security, safeguarding data for decades.
The “harvest now, decrypt later” threat
“Harvest now, decrypt later” is an attack where adversaries collect your encrypted data today, knowing they can’t break it now. They simply store it and wait for future quantum computers to become powerful enough to decrypt it. PQC integration is the only way to protect today’s data from tomorrow’s computers, making that stored data useless to them.
PQC’s impact on network performance in a SASE framework
Yes, there can be a slight performance hit. PQC algorithms sometimes have larger keys or signatures than classical ones, which can add a bit of computational overhead or use more bandwidth. But modern SASE platforms from providers like Lumen are built on high-capacity networks with optimized processing specifically to minimize this impact, so most end-users won’t even notice it.
Fortinet products needing PQC updates for SASE
For a Fortinet SASE deployment, the key products you’ll need to update are your FortiGate firewalls and the FortiClient endpoint software. You’ll also need to check FortiManager for centralized policy updates. Basically, any component that builds a VPN tunnel, does SSL/TLS inspection, or handles digital certificates will need to be PQC-compatible.
How Lumen’s SASE helps PQC for distributed workforces
Lumen’s SASE uses its global network fabric to make sure PQC-secured traffic from your remote workers gets routed efficiently over high-performance connections. It connects users directly to the closest network point and finds the fastest path to the application they need. This slashes latency and improves the user experience, all while maintaining the strong PQC encryption.
Immediate steps to prepare for PQC in your SASE
The first things you should do are take a full inventory of all your cryptographic assets and assess your current Fortinet SASE deployment. At the same time, you need to talk to your Certificate Authority provider about their PQC readiness. Start tracking NIST’s PQC standardization progress and make a plan for the firmware upgrades and policy changes that will be required when vendors like Fortinet release PQC-compatible software.
