Case Studies/Lumen Systems
Mapping quantum exposure before cryptographic standards move
Lumen already had audits and legal opinions on file. What it did not have was an owner for post-quantum risk as validators, wallets, and client assets continued to rely on today's signatures.
- Inventory complete
- PQC
- Migration plan
- Horizon
- Algorithm agility
- Retained
The challenge
The gap after delivery
Security and legal work had both closed. Quantum was treated as a future press topic. Meanwhile harvest-now-decrypt-later collection against long-lived keys was already a planning problem.
- No catalogue of ECDSA, Ed25519, and TLS suites across nodes, APIs, and client tooling.
- Upgrade paths assumed today's curves would remain the production default.
- No retained team to carry a multi-year migration without reopening live security risk.
What Avenza did
One continuous workstream
Avenza ran a cryptographic inventory and threat assessment, then folded the migration roadmap into the same retained security-and-maintenance relationship Lumen already needed for day-to-day operations.
- Inventoried signature schemes, key lengths, and certificate lifetimes across the stack.
- Modelled harvest-now-decrypt-later exposure for high-value, long-lived assets.
- Drafted a staged migration to NIST-aligned post-quantum primitives with rollback paths.
- Kept the roadmap on retainer so it would not become another closed PDF.
Outcomes
Cover that did not end
Quantum stopped being an orphaned workstream. It sat inside the same continuous cover as live security and infrastructure.
- Board-level exposure horizon with named owners and dates.
- High-risk long-lived keys flagged for earlier rotation.
- Migration gates added to the existing upgrade and incident process.
- Avenza Standard future-readiness scoring included in institutional client reviews.
“We had already bought the audit and the opinion. Quantum was the gap with nobody on it. That is the relationship Avenza took.”
More engagements
Related case studies
Northstar Exchange
Regional digital-asset exchange
Licensing a GCC exchange without splitting security from the filing
A regional exchange expanding into the UAE needed VARA-ready compliance, AML/KYC operations, and a live security posture — owned by one partner, not three vendors.
Helix Markets
Established on-chain trading protocol
What happens after the audit PDF — when no one stays on the system
Helix had already paid for a one-off security review. Code shipped, the engagement ended, and the protocol kept changing. Avenza became the partner that did not leave.
Meridian Issuance
Tokenization platform preparing a fundraise
Security and MiCA credibility before a tokenization launch
A tokenization startup needed more than a logo on a pitch deck. Investors wanted a defined bar for smart-contract security and EU regulatory readiness — owned as one relationship.
Ready to unify security and compliance?
Avenza stays on the account — so the system is not unmonitored the day after delivery.