For thirty years, ‘too hard to exploit’ was a security strategy. This month, AI retired it. If your encryption still runs on a general-purpose software stack, every layer of that stack is now a target that machines can find, weaponise and hit faster than any human can patch.

A fourteen-year-old flaw. Found in 2024. Ignored. Exploited by AI in weeks.

This week, governments on both sides of the Atlantic pulled websites offline. Thirty-two UK government services went dark and four more were partially unavailable. The National Cyber Security Centre fired out more than 50,000 warnings to British organisations in little over a day. Cloudflare counted tens of thousands of exploit attempts within 45 minutes of disclosure, hundreds of thousands within two hours, and millions by the evening.

The cause was not a new bug. It was a flaw that had sat in one of the most widely deployed pieces of software on the planet for fourteen years, underpinning roughly 70% of the web. Human researchers had actually found a version of it in 2024 and set it aside, judging it too complicated to turn into a working exploit. That judgement held for two years. Then frontier AI models looked at the same code and turned the ‘unexploitable’ into remote code execution.

“Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit… This changes the economics of both discovery and exploitation.” Wiz Research, disclosure write-up, October 2026

The researchers who found it described it as ranking among the most severe vulnerabilities ‘arguably in software history’. OpenAI, whose models were involved in the discovery, was candid about what it means for the other side: ‘To our knowledge, frontier AI found these vulnerabilities before attackers did… the same capabilities can also help attackers rapidly develop offensive tools and exploits’. OpenAI, October 2026

Read that twice. The defenders got there first, this time, by weeks. The capability that found the flaw is not proprietary to defenders. It is a general property of the models, and the models are everywhere.

This was not a one-off. It is the new baseline.

Go back six months and the pattern is already there. In April, Anthropic disclosed that its Mythos model had, inside a few weeks, found thousands of previously unknown vulnerabilities across major operating systems, browsers and open-source libraries. Among them: a 27-year-old bug in OpenBSD, a 16-year-old flaw in FFmpeg that had survived more than five million automated fuzz tests, and a 17-year-old remote code execution bug in FreeBSD that the model discovered and exploited autonomously from a single prompt. In a benchmark against the Firefox JavaScript engine it converted known vulnerabilities into working shell exploits 72% of the time. Anthropic’s own red team noted that none of this came from security-specific training; it was, in their words, ‘a downstream consequence of general improvements in code, reasoning, and autonomy.’

In September, Anthropic’s threat intelligence report described live criminal and state operations in which one stolen developer token was turned into full cloud administrative control in roughly three hours, in which a Chinese-speaking espionage group ran ‘agent swarms’ with persistent campaign memory against around 50 organisations, and in which a single vulnerability-research workflow produced more than a dozen candidate zero-days in a month.

In October, Microsoft’s Digital Defense Report put numbers on the compression. The median time from a vulnerability being discovered in the wild to being weaponised is now well under 24 hours. 2026 is on course for a record of roughly 72,000 tracked CVEs. In Microsoft’s own test environment, frontier models took control of an entire enterprise domain through a 32-step attack chain.

“AI is changing the physics of cybersecurity.” Microsoft Digital Defense Report 2026

And the NCSC, speaking on its tenth anniversary, was blunter still about who is using these tools. All four of the UK’s principal state adversaries, China, Russia, North Korea and Iran, now use AI to increase the output of their attacks.

“They don’t need sleep, coffee, food or anything like that.” Paul Chichester, Director of Operations, NCSC, October 2026

The warning from the top of government

Yesterday, the UK Defence Secretary stood in a munitions factory and told the country to stop using polite language for what is happening. Terms like ‘hybrid warfare’ and ‘grey zone’, he said, do not convey the reality to the public. He prefers ‘state-sponsored terrorism’. He asked whether businesses were prepared for ‘increasingly sophisticated cyberattacks’, for disruption to essential supply chains by hostile states, and then put the question in terms anyone can picture:

“How would we cope if the payment systems of the supermarkets went down?” Wes Streeting, UK Defence Secretary, 22 October 2026

These threats, he said, are ‘not hypothetical but real, and not somewhere else but increasingly here’, and ‘we have to step up and take seriously our national resilience as well as our national defence.’

He is not alone. In June, the head of the NCSC told the RUSI Annual Security Lecture that the Centre had handled more than 200 incidents against UK critical national infrastructure and its supply chain in a year, around three-quarters of them linked to state actors, and that the NCSC assesses attackers will likely be using AI-enabled capabilities to exploit known vulnerabilities in legacy technology at scale across CNI by 2028.

“The many vulnerabilities that organisations tolerate today will be exploited in conflict tomorrow… In cyberspace, we are not preparing for tomorrow’s conflicts, to some degree we are fighting them today.” Dr Richard Horne, CEO, NCSC, June 2026

Back in May the NCSC’s Chief Technology Officer warned every organisation to prepare for a coming ‘patch wave’ as AI accelerated vulnerability discovery. Five months later it arrived, and he was the one issuing the 50,000 warnings.

What this does to the attack surface

Strip away the headlines and three things have changed, permanently.

• Latent is now live. Decades of technical debt in operating systems, libraries, drivers and firmware used to be protected by obscurity and difficulty. AI has removed both. Every line of general-purpose code you run is a candidate.
• The patch window is gone. As Professor Alan Woodward put it this week, ‘there’s always a window between the flaw being publicly known about and it being patched.’ That window is now measured in minutes, and attackers are automated while most patching is not.
• Trust in credentials is collapsing. Stolen tokens and residential proxies make hostile access look legitimate, and AI agents can turn one credential into an entire estate before a SOC analyst finishes their coffee.

Now look at where most organisations keep their encryption. It sits at the top of a software stack: an application, calling a crypto library, running on an operating system, over drivers and firmware, on a CPU with shared memory. Every one of those layers is general-purpose code with a patch history. Every one of them is exposed. And the keys, the one thing the whole arrangement exists to protect, live in system memory, reachable through side channels and privilege escalation. When the OS falls, the keys fall with it.

That stack was an acceptable risk when exploits took skilled humans months to build. It is not an acceptable risk when they take an agent an afternoon.

Shrink what can be attacked. Move what cannot be stopped.

The alternative is not to patch harder. It is to give attackers less to attack. Sitehop puts the encryption path onto fixed-function logic in an FPGA inside a single hardware boundary. There is no general-purpose operating system in the data plane, so there is no OS vulnerability to find. Keys are generated, stored and used inside that boundary and never leave it, designed to FIPS 140-3 Level 3; there is no memory for an escalated process to read. Secure boot and hardware attestation make the device tamper-resistant by construction, and zero-trust segmentation is anchored to hardware identity rather than to a credential that could have been bought on a forum last Tuesday.

This is what shrinking the attack surface means in practice: fewer layers, fewer lines of code, fewer things that can be wrong, and no soft target in memory for an AI-written exploit to go after.

It also means moving at speed. Encryption in silicon runs at line rate, 1G to 100G, with no CPU tax and no ‘inspection’ hop where traffic is briefly in the clear. For defence, finance, critical infrastructure and OT, where links are contested, intermittent or denied, tunnels re-establish automatically when the link returns, without an operator in the loop. Security that waits for a human is security that loses to a machine.

Quantum is the next wave, and it is already breaking

Everything above is happening before the quantum threat matures. Adversaries are harvesting encrypted traffic today to decrypt it later, and the migration to post-quantum cryptography is a race with a hard deadline. A software stack that struggles to patch a 14-year-old memory bug in time is not going to re-platform its cryptography gracefully. Sitehop’s architecture is crypto-agile and PQC-ready: algorithms can be swapped and upgraded within the hardware boundary without rewriting applications or redesigning the network. Security evolves in step with the threat, not three years behind it.

The question for every board

The UK Defence Secretary asked the country a question about supermarket payment systems. Boards should ask themselves a sharper one: if an AI finds the next fourteen-year-old flaw in your software stack tomorrow, and the exploit is live within the hour, what is still protecting your data in motion?

If the honest answer is ‘the same operating system the exploit just took’, you do not have encryption. You have a promise, and the machines have stopped keeping it.

Shrink the attack surface. Put the keys where no software can reach them. Move at the speed of the threat with hardware encryption.

Book a Sitehop demo to see how hardware-enforced segregation and crypto-agile encryption keep a single breach from becoming a business-wide incident.

Stay in touch with Sitehop’s latest thinking, subscribe to our PQC Bulletin.

Or call us: +44 (0)114 478 2366

Sitehop. Engineered for resilience. Built for the life.

 

 

Sources

Wiz / OpenAI quotes, CVSS, timeline, 70% figure –https://securityboulevard.com/2026/10/most-of-the-worlds-websites-threatened-by-critical-php-flaws-found-with-ai/

14-year history, 2024 partial discovery, Cloudflare exploit counts, OpenAI ‘offensive tools’ quote –https://fortune.com/2026/10/21/ai-tools-discovered-the-php-vulnerability-that-could-take-down-70-of-the-internet-now-the-race-is-on-to-patch-it-before-ai-powered-hackers-attack/

32 UK services offline, 50,000 NCSC warnings (Whitehouse), Woodward quote –https://www.itv.com/news/2026-10-22/more-than-30-government-services-offline-amid-global-php-cybersecurity-threat

Baroness Lloyd and No.10 quotes –https://www.lbc.co.uk/article/74365c9975d1467496696a1be806a306-5HjdkGW_2/

Streeting speech, Telford, 22 Oct 2026 –https://newswav.com/article/prepare-for-state-sponsored-terrorism-and-cyber-attacks-to-cause-food-short-A2610_CxxTqf

Horne RUSI lecture: 200+ CNI incidents, 75% state-linked, 2028 assessment –https://www.ncsc.gov.uk/news/ncsc-ceo-hostile-states-linked-to-three-quarters-of-cyber-attacks

Chichester ‘no sleep’ quote; four adversaries using AI –https://www.resultsense.com/news/2026-10-15-ncsc-chichester-adversaries-ai-cyber-attacks/

NCSC ‘patch wave’ warning (Whitehouse, May 2026) –https://therecord.media/british-cyber-ai-patch-wave

Microsoft Digital Defense Report 2026 figures and quote –https://www.helpnetsecurity.com/2026/10/02/ai-cybersecurity-threats-microsoft-report/

Anthropic threat intelligence report, Sept 2026 –https://www.anthropic.com/threat-intelligence-report-september-2026

Mythos / Project Glasswing findings, April 2026 –https://oasis.security/blog/claude-mythos-project-glasswing-security-teams

For a long time, retail cyber security was built around a single idea: keep the attackers out. Build a strong perimeter, patch the gaps, and hope the walls hold. That idea is no longer enough. The retailers pulling ahead have accepted an uncomfortable truth and built their strategy around it. Sooner or later, something gets through, and what matters most is what happens next.

Retail cyber security can no longer assume the walls will hold

The attack surface has exploded. Payment data now moves through POS terminals, self-checkout, kiosks, ATMs, e-commerce sites, mobile apps and a web of third-party links. Every one of those is a potential way in. At the same time, attackers have become faster, better organised and more focused on disruption than ever.

The made the point plainly. These were not small, obscure businesses. They were large, well-resourced brands with security teams, and they were still knocked offline for weeks. Prevention still matters, but prevention on its own is a losing bet.

From prevention to resilience

Resilience is the shift from stopping every attack to surviving the ones that land. A resilient retailer assumes a breach will happen and designs so that a single compromise stays small, contained and survivable, rather than spreading into a business-wide crisis.

Prevention asks how we keep attackers out. Resilience asks how we keep trading when they get in.

That change in mindset is why resilience now sits at the centre of serious retail cyber security strategies, rather than off to the side as a disaster-recovery afterthought.

What resilience looks like in practice

Resilience is not one tool. It is a set of design choices that work together:

• Containment: segmenting the network so an intruder who reaches one area cannot roam freely into payment systems and beyond.
• Encryption: protecting payment data in motion, so that even intercepted traffic is useless to an attacker.
• Continuity: keeping critical systems trading, or recovering them quickly, when something goes wrong.
• Central control: managing policy, keys and configuration across every store from one place, so you can respond fast and consistently.

Done well, these choices limit the blast radius of any single incident. The goal is simple to state: one compromised device, store or link should never be able to bring down the whole business.

Customer data protection is part of resilience

Resilience and customer data protection are two sides of the same coin. Much of what a retailer holds, from cardholder data to loyalty and account details, is exactly what attackers are after. Strong customer data protection, built on encryption and tight control over who and what can reach sensitive information, both reduces the chance of a damaging breach and limits the harm when one occurs.

It also protects something harder to rebuild than any system: customer trust. Effective customer data protection keeps a bad day from becoming a lasting reputational wound, and cardholder data protection in particular sits at the heart of meeting PCI DSS 4.0 objectives.

Preparing for what comes next

A resilient strategy also looks forward. Cryptography itself is changing, with post-quantum computing on the horizon and encrypted data captured today at risk of being broken later. Building on crypto-agile foundations, able to adopt new standards without replacing every device, is how retailers stay resilient against tomorrow’s threats as well as today’s.

Resilience is the strategy

Retail cyber security is no longer about building a taller wall. It is about designing a business that keeps running, keeps protecting its customers and keeps earning trust, even under attack. Resilience is what ties payments, data protection and continuity into one coherent strategy.

Sitehop helps retailers build that resilience: end-to-end encryption for payment data, protection for data in motion, and crypto-agile, PQC-ready security that spans every store and network without slowing operations. To see how it works in the field, read how SAFEcore Edge secures data from the field to HQ.

Build retail cyber security that bends without breaking.

Book a Sitehop demo to see how resilient encryption protects payments and customer data across your estate.

Sitehop. Engineered for speed. Built for the future.

A modern military mission doesn’t begin when troops deploy, a ship leaves port or an aircraft takes off.

It begins when data starts moving.

Mission plans, intelligence, sensor feeds, logistics, communications and command decisions all travel across networks long before people or platforms move into position. If that data is delayed, exposed or compromised, the mission is already at risk.

For decades, defence organisations have invested heavily in protecting physical assets. Yet many of the networks connecting those assets still rely on infrastructure designed years, sometimes decades, ago. Replacing those systems isn’t practical and, in many cases, isn’t even possible.

The challenge facing defence today is no longer simply how to build the next generation of secure networks. It is how to secure the networks already carrying today’s missions.

Legacy isn’t the problem. Leaving it exposed is.

Defence has always been different from the commercial world.

Platforms remain operational for decades. Radar systems, communications equipment, naval platforms, vehicles and industrial control systems frequently outlive several generations of IT. They continue performing critical roles long after the software around them has evolved. Replacing those systems simply because cryptography has changed isn’t financially or operationally realistic.

Instead, organisations face a far more pressing question: how do you protect long-life assets without redesigning everything around them?

And just because legacy platforms can stay in place doesn’t mean the threat is standing still with them. Modern warfare is evolving quickly: contested and denied spectrum, autonomous systems, and adversaries who go after the weakest link in a network rather than the newest one. Protecting what’s already in the field is only half the challenge. Defence also needs new, innovative approaches, delivered by companies built to move at the pace the threat now demands, not the multi-year timelines legacy suppliers were designed around.

As post-quantum cryptography (PQC) becomes a national priority, many are beginning to recognise that the answer lies in securing what already exists, rather than replacing it. One increasingly attractive approach is to create a cryptographic overlay around legacy equipment, surrounding trusted systems with modern protection while leaving proven operational behaviour untouched. Applications continue working exactly as before; only the security surrounding them changes. That emerging approach formed a central theme of our recent defence strategy discussion.

Performance is operational assurance

Security has traditionally been viewed as a compromise. Stronger encryption often meant more latency, lower throughput or changes to application behaviour.

In defence, those compromises simply aren’t acceptable.

Whether protecting a radar system, command network or autonomous platform, operators need confidence that introducing stronger security will not alter timing, packet flow or system performance.

The goal isn’t simply faster encryption. It’s deterministic performance, where security becomes effectively invisible to the application. Networks behave exactly as they always have, only with stronger protection around every packet.

When engineers can introduce modern cryptography without changing how systems communicate, upgrading security becomes significantly less disruptive.

Why hardware matters

Most modern security platforms rely heavily on software, delivering flexibility but also increasing complexity. Every operating system, software library and management layer expands the potential attack surface.

Hardware-enforced security takes a fundamentally different approach.

Rather than processing sensitive traffic through multiple software layers, cryptographic operations are isolated inside dedicated hardware, while management functions remain separate from customer data. The result is a smaller attack surface, clearly defined cryptographic boundaries and an architecture that is easier to audit and trust. During our discussion, this separation between management, configuration and data planes emerged as one of the key differentiators for high-assurance environments.

For defence organisations, that physical separation provides something increasingly valuable: certainty. Security teams know exactly where encryption begins, what protects it and where the cryptographic boundary sits.

Commercial innovation is strengthening national security

Some of the most valuable innovation now entering defence has been refined elsewhere.

Global telecommunications providers have spent years solving problems around resilience, availability, segmentation and operating secure networks at enormous scale. Those lessons translate remarkably well into national security environments.

Capabilities originally designed to isolate customers across multinational telecoms networks can also isolate users, systems and operational domains within defence. Instead of flat architectures where compromise can spread laterally, organisations can build segmented environments that reduce blast radius and contain attacks far more effectively.

The technology may have matured in commercial networks, but its operational value is increasingly being recognised in defence.

Modernisation doesn’t always mean replacement

Quantum computing, AI-assisted cyber attacks and increasingly sophisticated nation-state threats are accelerating the need to modernise security. Yet modernisation should not automatically be confused with replacement.

For organisations responsible for defence, government and critical national infrastructure, the most practical path forward is often to retain trusted platforms, preserve operational workflows and simply modernise the protection surrounding them.

That approach avoids costly infrastructure refresh programmes while enabling organisations to strengthen security today rather than waiting years for complete system replacement.

Before the mission moves…

Every mission depends on trust.

Trust that systems behave predictably. Trust that information arrives intact. Trust that communications remain confidential. Long before a vehicle moves, before a sensor reports or before a commander makes a decision, data is already travelling across the network. Protecting that journey is rapidly becoming one of the defining cybersecurity challenges of the next decade. Because in modern defence, the first thing that moves is rarely the mission itself.

It’s the data.

For organisations looking to strengthen security without replacing the infrastructure they depend on, Sitehop’s SAFE Series™ provides a hardware-enforced cryptographic overlay designed for mission-critical networks. Spanning core, edge and centralised management, the platform delivers deterministic, ultra-low-latency encryption, physical network segmentation and post-quantum cryptographic agility, enabling defence, government and critical infrastructure organisations to protect legacy and modern systems alike while preserving the performance and resilience their missions demand.

Read the full PQC Migration Readiness Guide and explore more at sitehop.com

Book a Sitehop demo to see how end-to-end encryption keeps data safe.

Or call us: +44 (0)114 478 2366

Sitehop.

Sitehop. Engineered for resilience. Built for the life.

PCI DSS 4.0 has pushed payment security up the boardroom agenda. Most retailers have responded by tightening the obvious things: who can reach cardholder data, how it is stored, how systems are monitored. All of that matters. But one gap gets missed again and again, and it hides in the space between systems. The risk is not just the data sitting in a database. It is the data on the move.

What is data in motion security?

Data in motion security is the practice of protecting information while it travels between systems, rather than while it sits in storage. Data at rest lives in a database or on a disk. Data in motion is in transit, moving from one place to another.

In retail, that journey is constant. Card and payment data travels from a POS terminal or checkout to a payment gateway, an acquirer, a data centre or the cloud, across whatever network sits in between. Encrypting stored data is now well understood. Protecting payment data at every step of that journey is where many retailers still fall short.

Why PCI DSS 4.0 sharpens the focus on data in transit

PCI DSS 4.0 raised expectations across encryption, key management, monitoring and validation. Requirement 4 is explicit: cardholder data must be protected with strong cryptography whenever it is transmitted across open or public networks. You can read the standard itself on the PCI Security Standards Council site.

The message is hard to miss. Encryption in transit is no longer optional or assumed. It is expected, and it is tested. Sitehop supports these objectives, though full PCI DSS compliance always remains the retailer’s own responsibility.

The retail blind spot: a sprawling estate, data everywhere

Modern retail runs on a wide, distributed estate. POS terminals, self-checkout, kiosks, ATMs, e-commerce platforms and mobile apps all handle payment data, and all of it has to move: between stores and head office, between sites and data centres, out to payment processors, across MPLS, the public internet, 5G and private networks.

Every one of those links is a place where data in motion could be intercepted. Attackers understand that endpoints are increasingly well defended, so the connections between them become the target. The more places data travels, the more the gaps multiply.

How encryption and network segmentation close the gap

Two mechanisms do most of the heavy lifting here.

The first is strong, end-to-end encryption. When payment data is encrypted for its whole journey, anyone who intercepts it finds nothing usable, only scrambled traffic. The data protects itself, wherever it goes.

The second is network segmentation. By dividing the network into separate zones and keeping payment systems apart from everything else, network segmentation limits how far an attacker can move and shrinks the area that must be secured and audited. It also helps reduce PCI DSS scope, which lowers both cost and complexity.

Encryption protects the data itself. Network segmentation controls where it can travel. Strong data in motion security needs both.

 

Used together, encryption and network segmentation turn a flat, open estate into something far harder to exploit.

Building data in motion security that lasts

The threat does not stand still, so the protection cannot either.  Encrypted traffic captured today could be stored and broken later, once quantum computing matures. That is why crypto-agility matters: the ability to update ciphers and keys without ripping out equipment across hundreds of stores. Managing that centrally, with consistent policy and key control at scale, is what keeps a large retail estate protected as standards evolve.

Closing the gap

Stored data is only half the picture. The retailers who take PCI DSS 4.0 seriously are the ones giving data in motion security the same attention they already give data at rest.

Sitehop protects payment data wherever it moves, with end-to-end encryption across any network, centralised policy and key management, and a crypto-agile, PQC-ready design that supports PCI DSS 4.0 objectives without disrupting stores or slowing payments. To see how it works at the edge, where payment data first meets the network, read how SAFEcore Edge secures data from the field to HQ.

 

Close the data in motion gap across your payment estate. Book a Sitehop demo to see how encryption and segmentation protect payment data end to end.

Book a Sitehop demo to see how end-to-end encryption keeps payment data safe across every store, network and payment system.

Or call us: +44 (0)114 478 2366

Sitehop.

Sitehop. Engineered for speed. Built for the future.

No shopper ever chose a store because it passed its last PCI DSS audit. They choose you because the checkout is quick, the app remembers their details, and nothing about handing over a card makes them pause. That pause, or the absence of it, is where retail is won and lost. Underneath it sits something customers rarely name but always feel: payment security. It is the quiet foundation of customer trust.

 

Compliance is the floor, not the finish line

Retailers put enormous effort into standards like PCI DSS 4.0, and they should. The bar is higher than ever, with tougher expectations for encryption, key management and monitoring. But compliance is the minimum you must meet to be allowed to take payments. It does not capture how safe your customers actually are, or how safe they feel.

Food hygiene works the same way. A passing inspection means a kitchen meets the rules. It does not, by itself, make anyone love the restaurant. Trust is built on everything a customer experiences, and it can be lost in a single bad moment.

 

Compliance is the minimum you must do to take payments. Trust is the reason customers come back.

What customers are really handing you

Every transaction is a small act of faith. Tap a card, open your app, check out online, and a person is giving you data that could be used against them, on the understanding that you will keep it safe. That understanding now stretches across a far wider surface than it once did:

• POS terminals and self-checkout on the shop floor
• Kiosks and ATMs
• E-commerce sites and mobile apps
• The third-party links and networks tying them all together

Every one of these is a place where payment data moves. And every point where data moves is a point where it could be exposed. Customers never see this complexity. They simply expect it to work, safely, every single time. That expectation is customer trust in its purest form.

Why a breach costs far more than a fine

When payment security fails, the fine is rarely the worst of it. Penalties hurt, but they are finite. The damage that lingers is to reputation. News of a breach travels further than any campaign you could buy, and the customers who leave are often the loyal, high-value ones who felt personally let down.

The pattern is familiar to anyone in retail. Trust is earned slowly and lost quickly.

Winning a customer’s trust takes years. Losing it can take a single breach.

A breach flips your most valuable asset, customer confidence, into your heaviest liability.

Payment security is how trust is kept

If trust is the goal, payment security is how you protect it every day. The most overlooked part is data in motion: the payment information travelling between tills, stores, data centres and processors. Firewalls guard the edges, but the data itself needs protecting while it moves, right out to the edge where payments actually happen.

This is where strong, always-on encryption earns its keep. When payment data is encrypted from end to end, anyone who intercepts it finds nothing they can use. Done well, that protection runs silently in the background, without slowing the checkout or adding hassle for store teams. Customers get the two things they came for at once: speed and safety.

Building trust that outlasts the checklist

The retailers who will still be trusted in five years are already looking past today’s requirements. Threats change, and so does cryptography. Post-quantum computing is coming, and the encrypted data captured today could be the target tomorrow. Building on encryption that can adapt, without tearing out every terminal, is how a brand keeps its promise to customers for the long haul, not just the current audit cycle.

That is the real prize. Not a certificate on the wall, but a customer who never thinks twice about paying you.

 

Secure payments, protected trust

Compliance will always matter. It is where the conversation starts, though, not where it ends. The retailers who pull ahead treat payment security as the foundation of customer trust and brand reputation, rather than a box to tick once a year.

Sitehop helps retailers protect payment data wherever it moves, supporting PCI DSS 4.0 objectives today and a post-quantum future tomorrow, all without slowing payments or disrupting stores.

 

 

Protect your customers’ trust, from the checkout to the core.

Book a Sitehop demo to see how end-to-end encryption keeps payment data safe across every store, network and payment system.

Or call us: +44 (0)114 478 2366

Sitehop.

Sitehop. Engineered for speed. Built for the future.

The story of cybersecurity doesn’t have to be one of fear. It can be one of confidence, of businesses, governments, and individuals moving faster because they trust the systems they use. In an era when everything from financial transactions to energy depends on connected infrastructure, the attack surface, every point where systems can be compromised, has become one of the defining measures of digital resilience.

Rethinking the Modern Attack Surface

Today’s digital ecosystems are a vast web of distributed applications, cloud services, connected devices, and global networks all exchanging data across borders and time zones. It is the data in motion between endpoints that has become the most exposed. While data at rest often resides behind firewalls or within encrypted storage, data in motion travels through routers, gateways, and public infrastructure. Each transfer creates a point of vulnerability, an opportunity for interception, manipulation, or exploitation.

The real challenge lies in how data is handled as it moves. Most VPNs and network security systems still process customer data in software before handing it off to an ASIC to accelerate certain cryptographic functions. This approach exposes the data within the software stack, where most vulnerabilities exist. By contrast, processing customer data directly within hardware, such as an FPGA or ASIC, removes that exposure entirely. It allows encryption and protection to begin at the very first point of contact, before the data ever touches an operating system or software layer, closing one of the most significant gaps in today’s digital security model.

Common weak points include:

• Unsecured or misconfigured tunnels, where encryption isn’t applied end-to-end.
• Software-defined networks, where shared resources expose encryption keys to potential side-channel attacks.
• Edge and IoT devices, which transmit sensitive data without hardware protection.

Each of these represents not just a technical risk, but a business risk. When data in motion can be intercepted or altered, confidence in the entire digital supply chain erodes. The challenge isn’t simply to encrypt more, but to encrypt smarter, to build protection into the fabric of communication itself, without slowing the flow of data or business.

The Hidden Cost of Software Encryption

Software encryption has long been the default. It’s adaptable, deployable anywhere, and easily updated. But it also shares the same resources, the same memory, CPU, and operating environment, that attackers can exploit. Every software patch, every new algorithm, adds friction. The system slows down, the complexity grows, and the attack surface widens.

In the end, the protection becomes its own bottleneck. What began as a safeguard starts holding back performance, scalability, and trust.

Hardware Encryption: Security at the Speed of Life

Encryption must be part of the very fabric of technology, built into silicon, operating at line speed, invisible to users yet impenetrable to attackers. This is hardware encryption, and it represents a profound shift in how we think about both security and performance. By isolating cryptography within dedicated hardware, organisations can:

• Eliminate software vulnerabilities from the encryption path.
• Scale securely, maintaining performance as data volumes and key sizes grow.
• Protect keys absolutely, safeguarding against both cyber and physical compromise.

And the impact reaches beyond data centres or enterprise networks. When encryption happens seamlessly and instantly, it touches everyone. Reducing the attack surface doesn’t just protect systems, it protects experiences. It builds a world where trust is engineered, not assumed.

Beyond Today: Quantum Threats and Crypto Agility

The next wave of change is already on the horizon. Quantum computing promises unprecedented computational power, and with it, the potential to break today’s strongest encryption. The solution is crypto agility. Hardware-based designs make this agility possible. Algorithms can be upgraded without rewriting software or redesigning infrastructure. Security evolves in step with innovation, not in reaction to it.

The Strategic Payoff: Security as a Business Accelerator

For CIOs, CISOs, and network architects, encryption done right isn’t just a technical necessity, it’s a strategic advantage.

• Performance and protection align: systems stay secure without slowing down.
• Compliance becomes proactive: hardware simplifies certification and governance.
• Cost and complexity fall: fewer patches, fewer breaches, more uptime.
• Trust becomes measurable: secure-by-design enhances brand credibility.

How Sitehop Is Leading the Change

At Sitehop, that reality is here. Our hardware-accelerated, crypto-agile solutions deliver security at the speed of life, protecting data without compromise. Because when the attack surface shrinks, possibility expands.

 

To find out more, email info@sitehop.com

Or call us: +44 (0)114 478 2366

Sitehop.

Engineered for speed. Built for the future.