AT&T is bolstering its network-based Dynamic Defense offering with Palo Alto Network’s post-quantum cryptography (PQC)-enhanced Prisma secure access service edge (SASE) fabric to form a “quantum-resilient SASE fabric,” answering what the carrier is calling “an operational mandate.”

The integration extends Dynamic Defense to now include “cross-underlay consistency” that uniformly applies PQC protection across the carrier’s transport mediums, which include wireless 5G, fiber, and legacy systems. AT&T noted this eliminates “the ‘weak links’ that often exist in hybrid environments where data moves between private and public circuits.”

The integration uses service provider interconnect (SPI) to link Palo Alto Networks’ service natively with AT&T’s private network core. This allows AT&T Dynamic Defense customers to connect directly to a secure AT&T network and bypassing “software tunnels over the public internet.”

There is also automated PQC policy orchestration that uses automated policy distribution to “seamlessly” integrate branch locations into the fabric. This involves the use of hybrid public key infrastructure (PKI) to secure edge locations.

“The moment a device is activated via zero-touch provisioning, the branch is enabled to be protected against [harvest-now, decrypt-later] threats from the first packet without requiring manual site-by-site intervention,” the companies explained.

The integration also includes a “verifiable chain of trust” that can help organizations meet “quantum readiness” across the circuit path to meet “audit-ready and compliant with global standards.”

AT&T’s Palo Alto Networks push

AT&T launched Dynamic Defense in early 2024, positioning the service at the small- and mid-sized enterprise space. The offering touts malicious IP address blocking, next-generation firewall (NGFX) capabilities, and other advanced security features without the additional cost of installation and equipment.

AT&T last year added Palo Alto Networks to that offering in an attempt to move the Dynamic Defense platform upmarket. That integration routed network traffic first into AT&T’s Dynamic Defense base, with customers that sign up for the Palo Alto Networks components then having that traffic fed via direct connect into the vendor’s cloud.

Senthil Ramakrishnan, AVP of cybersecurity technology at AT&T, explained to SDxCentral at that time the integration was in answer to market demands.

“Once you go upper market, it's multiple layers. … Dynamic Defense became a layer, but it became apparent that we need to have more tech, more advanced security tech as part of the stack as well,” Ramakrishnam said. “As you start going up market, into enterprise, public sector, even our partner, indirect channels, it became very important that they have a much larger set of security requirements and capabilities, even if we're looking at just the network security area alone.”

Those security requirements include secure service edge (SSE) and SASE platforms that “became a lot more common even at the upper end of the mid-market where we’re seeing a lot of customers making that transition from pure [on-premises] solutions into more cloud-based security solutions,” Ramakrishnan added.

Now with more quantum

AT&T’s integration of Palo Alto Networks’ quantum SASE comes amid a growing push around PQC as interest increases around “Q-day.” That’s when there will be a quantum computing breakthrough that would render non-quantum-based cybersecurity systems obsolete, a date that some hyperscalers have warned could be as soon as the end of this decade.

The carrier earlier this year tapped Cisco to power a “quantum resilient” SD-WAN service that the carrier plans to launch later this year. That offering will include PQC running on Cisco’s 8000 Series Secure Router platform, providing quantum-resilient encryption, authentication, and secure boot capabilities, with PQC adhering to National Institute of Standards and Technology (NIST) standards.

“As enterprises make long-term decisions about how their networks will support increasingly sensitive data, quantum-related risk can no longer be treated as a distant concern," Joe Petrocelli, VP of communication services at AT&T Business, noted in a statement tied to the Cisco news. "By integrating post-quantum cryptography into our SD‑WAN offerings, we’re helping customers reduce their risk exposure and protect critical information for the future. Our continued collaboration with Cisco allows us to deliver business-grade connectivity that evolves alongside the security needs of highly regulated industries."

Cisco more recently upped its quantum network game through a trial with Aliro and zerothird using an Aliro-powered quantum network management layer for a live entanglement-based quantum key distribution (eQKD) network built on zerothird’s eQKD system.

As highlighted by our recent “SDxCentral Quantum Supplement,” QKD is increasingly being looked at as a way to produce and distribute cryptographic keys to secure critical data.

QKD uses the quantum state of photons to generate symmetric keys. If an attacker taps the fiber, the quantum state collapses, and interception is detected in real time. This is different from post-quantum cryptography (PQC) that strengthens the mathematics of cryptography, with QKD positioned as strengthening the physical medium through which data travels.