Netskope Adds PQC key exchange support to Next Gen SWG

Netskope says it has extended its post-quantum cryptography work into Netskope One Next Gen Secure Web Gateway by adding support for a hybrid X25519MLKEM768 key-exchange approach, intended to keep sessions protected if one algorithm set is broken.

Research Overview

The update is framed around the long-term risk that encrypted traffic captured today could be decrypted later if quantum computing capabilities improve.

Netskope also cites post-quantum cryptography standards work, noting that NIST finalized its first set of post-quantum cryptography standards in 2024 and that organizations are planning for PQC migration.

Key Findings

Netskope reports that it focuses on NIST ML-KEM 768 for stronger protection and extends that effort into its Secure Web Gateway.

For Next Gen SWG, it describes adding support for X25519MLKEM768, described as combining elliptic-curve cryptography key exchange with a post-quantum method to provide protection across both client-to-Netskope and Netskope-to-destination traffic directions.

Technical Breakdown

Netskope characterizes X25519MLKEM768 as a hybrid key-exchange method that pairs X25519 with ML-KEM 768.

It states this support is implemented for both directions of traffic and is intended so that a connection remains protected even if one of the two approaches is broken in the future.

Product Update

Netskope says the feature is a tenant-level option controlled by a feature flag, intended for controlled testing rather than a forced enablement.

It adds that the implementation is based on an OpenSSL 3.5 upgrade and that transaction events indicate PQC use.

Operational Impact

Netskope reports that the capability is available in commercial environments today.

It also states that support for other environments, including FedRAMP (US), PBMM (Canada), Data Plane on-Premises, and Virtual Private Edge, is planned for future releases.

This Netskope “Blog Signals brief” is a fact-based summary of a vendor blog update describing the addition of hybrid PQC key exchange support in Netskope One Next Gen SWG, including how it is enabled and where it is available.

Source: netskope.com, by Ankur Chadda.