Advancing cryptographic agility using AWS at Capital One

For years, Capital One has prioritized modernization and cloud security initiatives as part of its data and technology journey. As advances in quantum computing increased, the company recognized the potential for emerging risks associated with “harvest now, decrypt later” scenarios, where encrypted data could potentially be decrypted by future quantum systems.

Capital One wanted to proactively prepare for evolving cryptographic standards while minimizing operational disruption across large-scale environments. The company also recognized that adapting to future cryptographic changes would require greater cryptographic agility, visibility into assets, and nuanced security controls across teams.

Because much of the company’s technology already involves AWS managed services, Capital One was able to approach PQ readiness as an extension of its established cloud foundation rather than a large-scale infrastructure rebuild. Its existing AWS environment also reduced the complexity of future cryptographic transitions across workloads and traffic encryption services. “Working alongside AWS helped us move much more quickly as we advanced our post-quantum readiness efforts,” says Reetu Bok, lead product manager for cryptographic services at Capital One.

Capital One worked alongside AWS account teams and subject matter experts to align its cryptographic strategy with evolving PQ capabilities and service road maps. Internally, Capital One’s engineering, product, cyber, and leadership teams collaborated to strengthen cryptographic agility while simplifying adoption across teams.

For data at rest, Capital One used AWS Key Management Service (AWS KMS), which developers use to create and control keys used to encrypt data. This strengthened centralized cryptographic management and supported broader PQ-readiness efforts. Capital One also expanded its use of AWS Secrets Manager, which helps centrally manage the lifecycle of secrets. This simplifies future PQ migrations, facilitating lightweight client updates instead of large-scale redesigns.

For data in transit, Capital One used Elastic Load Balancing (ELB), which distributes network traffic to improve application scalability, and Amazon CloudFront to securely deliver content with low latency and high transfer speeds. These services helped simplify adoption of evolving TLS configurations and cryptographic standards. Capital One also adopted AWS Certificate Manager (ACM), a service for provisioning and managing SSL/TLS certificates, and AWS Certificate Manager Private Certificate Authority (ACM Private CA) to securely issue and manage private certificates. Support for ML-DSA certificate authorities in ACM Private CA helped Capital One evaluate quantum-resistant authentication and simplify future upgrades.

 

To strengthen cryptographic agility, Capital One integrated security controls into infrastructure provisioning and built internal discovery tooling to improve visibility into cryptographic inventory and usage across workloads. This tooling aggregates data from AWS Config—used to assess, audit, and evaluate resource configurations—and third-party products to compile operational metrics and inventory, including assets off the cloud. “The goal was to make these capabilities seamless so that developers could focus on core business problems rather than infrastructure complexity,” says Praveen Palaniswamy, senior manager of software engineering for cyber data protection at Capital One.

Operating in AWS simplified discovery and inventory management compared with traditional on-premises environments because cryptographic services, workloads, and configurations were already centralized across cloud infrastructure. “Being in AWS and operating in a single cloud environment helped streamline how we approached PQ readiness,” says Palaniswamy.

By building on its established cloud foundation to support PQ readiness, Capital One strengthened its security posture to stay adaptive to evolving cryptographic standards and respond to future risks. Capital One reported no noticeable degradation in application stability or performance during current PQ-related implementations. And when Amazon CloudFront launched its TLS security policy with PQ support, Capital One achieved enhanced protection against future quantum-computing threats without needing to take additional action.

Capital One’s existing AWS capabilities reduced engineering effort and simplified rollout activities. The majority of external certificate renewals are now completed automatically, helping reduce outage risk and simplify lifecycle management. Improved visibility into cryptographic inventory and usage also helped Capital One avoid important TLS certificates–related risks over a 1-year period.

The security foundations that support cryptographic agility, including strong automation and patching capabilities, are the same foundations that are needed to stay ahead of AI-based threats. Looking ahead, Capital One plans to continue advancing its broader cryptographic agility strategy as part of its long-term approach to PQ readiness. “Our goal is to be as mature as possible when it comes to cryptographic agility so we can adapt efficiently as cryptographic standards evolve,” says Bok.