Western Balkans Summit Highlights Supply Chain Risk and Quantum Cryptography Threats
The Sarajevo Cyber Security Summit 2026 brings urgent attention to the cyber resilience gaps facing Western Balkan nations, particularly around supply chain dependencies and critical service continuity. The 'harvest now, decrypt later' threat — where adversaries collect encrypted data today to decrypt it once quantum computing matures — means organizations that delay post-quantum cryptography transition are already accumulating risk. Critical infrastructure operators relying on interconnected third-party services face compounded exposure when any single supplier is compromised. Regional collaboration and structured incident recovery planning are essential, as smaller nations often lack the standalone capacity to respond effectively to sophisticated attacks. Beginning cryptographic agility planning now, before quantum threats fully materialize, is a matter of strategic necessity rather than optional preparation.
Tactical Insight
Immediate actions
- Begin a cryptographic inventory to identify all systems using RSA, ECC, or other quantum-vulnerable algorithms that will require migration.
- Assess third-party and supply chain dependencies to map which critical services rely on external providers that may themselves be vulnerable.
Long-term improvements
- Develop and test a post-quantum cryptography migration roadmap aligned with NIST's finalized PQC standards (FIPS 203, 204, 205).
- Establish formal supplier risk management programs that include regular security assessments and contractual security obligations for all critical vendors.
- Build regional incident response playbooks that account for cross-border critical infrastructure dependencies common in the Western Balkans.
Detection & resilience measures
- Implement continuous monitoring of supply chain software and hardware components to detect tampering or unexpected changes.
- Conduct regular tabletop exercises simulating supply chain compromise and cascading critical service failures to validate recovery plans.