The Crypto Agility Paradox: When Hardware Becomes Your Security Bottleneck

Most cybersecurity roadmaps don’t plan for 20-year-old firmware, but that’s the reality of operational technology (OT). In this episode, Cassie Crossley, Vice President of Supply Chain Security in the Global Cybersecurity & Product Security Office at Schneider Electric, offers a behind-the-scenes look at what it takes to secure industrial systems, from chips to code.

Cassie explains why crypto agility isn’t just about algorithm swaps, it’s a long-haul architectural rethink. She unpacks how Schneider built a five-year roadmap with CTO support, how they tackled challenges like legacy devices, hardware constraints, and root-of-trust dependencies, and why threat modeling needs to evolve for future-ready product design.

From hardware bill of materials (HBOM) to the rising importance of crypto BoMs, Cassie outlines the real work behind securing infrastructure that can't just be patched or replaced. Whether you’re building new systems or protecting the old ones, this episode will change how you think about quantum readiness in the physical world.

What You'll Learn:

Cassie Crossley is Vice President of Supply Chain Security in the Global Cybersecurity & Product Security Office at Schneider Electric. An experienced cybersecurity executive with a background spanning IT, product development, and data privacy, Cassie brings deep technical and strategic leadership to the challenges of securing operational technology (OT) and global supply chains. She has led major initiatives in software and hardware supply chain security and secure development across complex industrial environments. Cassie is also the author of Software Supply Chain Security: Securing the End-to-End Supply Chain for Software, Firmware, and Hardware, and a frequent speaker on advancing cybersecurity resilience in critical infrastructure.

While the industry has made strides in software bill of materials (SBOMs), hardware remains largely uncharted territory. Cassie shares how Schneider faces increasing demands, especially from governments, to provide hardware bill of materials (HBOMs), including country-of-origin data. But there’s no common standard, no clear sharing mechanism, and limited awareness in cyber teams unfamiliar with hardware manufacturing. Without visibility, hardware becomes a hidden risk.

Key Question: Do you know what’s in your hardware stack and where it came from?

Schneider’s crypto agility journey began with the goal of replacing a third-party crypto library, but quickly revealed broader architectural challenges. With thousands of legacy OT devices and products built across decades, encryption choices were deeply embedded. Agility meant revisiting old code, navigating hardware limits, and sometimes rethinking entire product lifecycles. This wasn’t a library swap, it was a multi-year evolution.

Key Question: Are your encryption decisions future-proof, or just convenient?

Not all encryption solutions are created equal. Cassie explains how Schneider evaluated both open source and commercial crypto libraries, often preferring the latter for better long-term support and accountability. In environments where safety, compliance, and product longevity matter, vendor-backed solutions offered the reliability that open ecosystems couldn’t always guarantee. The cost-benefit equation goes beyond code.

Key Question: What encryption models are you trusting and who’s supporting them?

Crypto agility didn’t come from a marketing push, it had top-level backing from Schneider’s Chief Product Security Officer and CTOs across business units. What made it work was realistic goal setting, not rushed deadlines, or some artificial urgency. Instead, a five-year roadmap gave teams time to audit, evaluate, and align without disrupting product lifecycles. The lesson here is that buy-in starts with credible execution plans.

Key Question: Does leadership understand the operational costs of crypto change?

Quantum computing was already on Schneider’s radar years ago, not because it was urgent, but because it was inevitable. Cassie emphasizes that crypto agility isn't just about today’s algorithms; it’s about building the capacity to adapt when tomorrow's threats arrive. That mindset, designing for change, not permanence, helped Schneider bake quantum readiness into long-term product strategies.

Key Question: If quantum hits in 2030, will your products be ready or still running 2010 firmware?

Many OT environments, including power grids and water treatment plants, run devices that aren’t connected to the internet and may not be patched for years. In some cases, integrators are gone, documentation is lost, and product changes risk disrupting safety systems. Cassie outlines how encryption updates in these systems often take a back seat to uptime, safety, and regulatory stability. Security strategy must be built around that reality.

Key Question: If your OT systems won’t be patched, how will they stay secure?

Standards like FIPS 140-3 and NERC CIP are important, but Cassie stresses that in OT, compliance is often a negotiation. Utilities may request future-ready encryption but continue running older product models through approved waivers and compensating controls. Instead of “rip and replace,” Schneider works to align compliance with risk, product timelines, and customer context. It’s about balance, not just checklists.

Key Question: Are you applying standards, or just checking boxes?

Encryption doesn’t live in isolation; it interacts with chips, memory constraints, and lifecycle decisions. Cassie explains how Schneider’s teams evaluate chip specs, trust vendor roadmaps, and plan for future requalification, all during product design. For long-lived OT devices, you don’t get a second chance to build in crypto resilience. You either plan ahead or pay later.

Key Question: Are your hardware teams thinking about encryption as deeply as your software teams are?

Cassie outlines how legacy (brownfield) and new (greenfield) systems require two distinct strategies. Brownfield systems demand risk-based prioritization and defensive depth. Greenfield systems offer the chance to integrate future-ready encryption, secure boot, and crypto agility from the start. Treating them the same is a recipe for friction and failure.

Key Question: Is your PQC plan flexible enough for both legacy and next-gen systems?

Before any strategy can succeed, organizations must know what systems they have, what encryption they're using, and who owns what. Cassie warns that most companies, especially those outside regulated industries, lack that basic visibility. Without inventory, PQC becomes guesswork. But with it, you can prioritize upgrades, assess compliance gaps, and engage vendors with confidence.

Key Question: Have you mapped your cryptography, and who owns it?

Want exclusive insights on post-quantum security? Stay ahead of the curve—subscribe to Shielded: The Last Line of Cyber Defense on Apple Podcasts, Spotify, and YouTube Podcasts.

✔ Get insider knowledge from leading cybersecurity experts.

✔ Learn practical steps to future-proof your organization.

✔ Stay updated on regulatory changes and industry trends.

Need help subscribing? Click here for step-by-step instructions.

Shielded: The Last Line of Cyber Defense is handcrafted by our friends over at: fame.so