Phio TX-Centralized Management Console 2.0

Quantum-Safe Networks at Scale

Most Post-Quantum Cryptography (PQC) programs stall at the same point. The inventory is underway, the budget request is in, and then someone asks how the team will deploy, monitor and maintain post-quantum protection across hundreds of sites with the staff it already has.

The federal numbers show the same gap. In October, GAO published the public version of its post-quantum readiness audit of the 24 CFO Act agencies. None of them fully addressed all three preparation practices GAO measured, and none had tested post-quantum cryptography in their own environment. Agencies also have new guidance requiring PQC migration plans by the end of October.

Planning is moving. Deployment isn’t. This week we released Phio TX-CMC 2.0, the newest version of the Centralized Management Console for Phio TX®. Here’s what changed, why the team built it, and how it supports quantum-safe network deployment without rebuilding your network.

How To Accelerate PQC Deployment

Harvest Now, Decrypt Later (HNDL) is why PQC deployment can’t wait. Adversaries collect encrypted traffic today and decrypt it once a cryptographically relevant quantum computer exists. The data at risk is the data crossing your network right now.

The industry said to start with inventory so that has been the focus.  However, inventory is hard because encryption is everywhere.  And inventory only gets you a task list, it’s not actually securing anything.  You also don’t need a finished cryptographic inventory to start. Inventory matters for the long program. But traffic leaving your data center and traveling across your network is exposed tonight.

So we start at the network. It’s a very large attack surface, and it carries the asset attackers want most: your data. Protect the network your connections data travels across and you protect everything on it. You are in control.

The hard part is operational. A post-quantum cryptography (PQC) program that’s slow to roll out and painful to change becomes one more stalled project. CMC 2.0 goes after that problem making it easy to monitor and manage quantum-safe networks at scale.

What’s new in Phio TX-CMC 2.0

CMC first shipped in April 2026 with centralized monitoring, configuration management, and node discovery and registration. It also added a geomap of key delivery paths and integration with existing SIEM and monitoring tools via Syslog support. Version 2.0 adds 3 capabilities.

Quantum-safe management tunnels

Protecting the data plane while the control channel, which carries management traffic and control data, still runs on classical crypto leaves an obvious vulnerability. We closed it. Communication between the console and each Phio TX node now runs over tunnels protected with PQC.  We call it QSL which stands for quantum safe layer.

Zero-Touch Provisioning

Zero-Touch Provisioning (ZTP) automates the first setup and configuration of Phio TX instances. This streamlines the deployment process for large rollouts.

We also simplified container enrollment and added support for restricted networks. That matters for segmented environments and air-gapped federal deployments, where pulling configuration from the internet isn’t an option.

A flexible naming taxonomy for PQC algorithms

PQC algorithms have already been renamed. CRYSTALS-Kyber became ML-KEM when NIST published FIPS 203 in August 2024. More name changes will come as standards and vendor implementations change. The new taxonomy maps those names so Phio TX keeps PQC operations running through the change. Nobody wants a 2 a.m. change ticket because a standards body updated a label.

Plan for the day an algorithm fails

Here’s the question I ask every team in a planning phase: what happens when the PQC algorithm you deployed breaks?

This has happened before. In 2022, researchers broke SIKE, a NIST round 4 candidate, using a single classical computer in about an hour. Rainbow, a round 3 signature finalist, fell the same year.

Our CEO, Eddy Zervigon, puts it this way: “The future of encryption is not a math problem, it’s an architecture problem.” New algorithms are one part of the answer. The other part is how fast you replace one.

Phio TX uses a dual-path architecture. Keys travel out-of-band, on a path separate from the data. Because key delivery is decoupled and algorithm-agnostic, Phio TX hot-swaps PQC algorithms on the fly. No downtime. No recertification cycle. No maintenance window.

That’s crypto-agility, the ability to update cryptographic algorithms and policies without disrupting infrastructure. Plenty of vendors put it on a roadmap slide. We ship it. Phio TX also uses Ephemeral Keys and Forward Secrecy (EKFS) with no pre-shared keys, so if a key is compromised it doesn’t expose past sessions.

CMC 2.0 carries that agility into daily operations. The naming taxonomy keeps policy stable through standards changes, and the console gives you one place to push and verify a change across every node.

Change nothing on the network you already run

Get quantum-safe right away while gaining visibility and control.  Phio TX enables you to migrate to PQC on your timeline and acts as a bridge to enable seamless migration to newer infrastructure.

It deploys as a container, a virtual machine, or a physical appliance. For Cisco environments that support SKIP and 3rd party applications, Phio TX-EM runs as a container. In a recent federal agency deployment, Phio TX-EM added post-quantum protection across existing network infrastructure without major hardware replacements.

CMC 2.0 manages those deployments across multiple vendors and distributed environments from one console. That matters for staffing too. GAO found 18 agencies reported a lack of cryptography expertise and had no plans to fill the gap. Fewer manual steps means operational efficiency, and less vulnerabilities due to manual misconfiguration.

Phio TX is the industry’s first FIPS 140-3 + FIPS 203 + Entropy validated solution: FIPS 140-3 CMVP Certificate #4850 (module), FIPS 203 CAVP Certificate #6060 (ML-KEM algorithm) and NIST Entropy Source Certificate #E79.

Frequently asked questions

What is Phio TX-CMC 2.0?

Phio TX-CMC 2.0 is the latest version of the Centralized Management Console for Phio TX, Quantum XChange’s Cryptographic Management Platform (Network and Data Security). It gives teams one console to monitor, configure and manage quantum-safe deployments across vendors and distributed networks. Version 2.0 adds quantum-safe management tunnels, Zero-Touch Provisioning and a flexible PQC algorithm naming taxonomy.

What is Zero-Touch Provisioning for post-quantum networks?

Zero-Touch Provisioning (ZTP) automates the initial setup and configuration of Phio TX instances. Instead of building each node by hand, teams enroll nodes centrally and push configuration from the console. ZTP shortens deployment across large, distributed networks, and Phio TX-CMC 2.0 pairs it with simpler container enrollment and support for restricted networks.

What happens to a PQC deployment if an algorithm is broken or renamed?

With Phio TX, you replace it in place. The dual-path architecture delivers keys separately from data and stays algorithm-agnostic, so Phio TX hot-swaps PQC algorithms with no downtime or recertification cycle. Phio TX-CMC 2.0 adds a naming taxonomy so standards-driven name changes, like Kyber becoming ML-KEM, don’t force emergency configuration changes.

Do I need a complete cryptographic inventory before deploying PQC?

No. Inventory supports long-term migration planning, but HNDL puts data in motion at risk today. Securing the network connections that data travels over cuts exposure now, without replacing infrastructure. Phio TX protects data in transit across the network, so teams start with their most exposed traffic while inventory work continues in parallel.

Ready to secure your network?

GAO’s audit shows agencies still planning. The next step is getting post-quantum protection into production, and that’s an operations job. Phio TX-CMC 2.0 protects the management channel with PQC, removes manual setup with Zero-Touch Provisioning and keeps PQC running through algorithm name changes. Add hot-swappable algorithms and you have a network architecture ready for the day an algorithm fails.

You keep the network you have. Your data in motion gets protected now. If you’re moving from PQC planning to deployment, my team will walk you through a rollout on your network.

Talk to an Expert