Most discussions of the post-quantum transition treat it as a software update: swap the key-exchange algorithm, redeploy, done. For an office network that is roughly true. For a substation, a hospital campus or a clearing house it is not, and the difference explains most of the design decisions behind Tessera.
The network is not the product
A grid operator’s network exists to carry control commands between substations and a control centre. Its routers, firewalls and tunnels were certified together, often years ago, and any change to them triggers re-testing, re-certification and a maintenance window that has to be negotiated with the operations team. Firmware that adds post-quantum algorithms to the edge router is still a change to the edge router. In practice it lands in the same queue as every other change, and that queue moves at the pace of the slowest site.
The same holds in healthcare, where clinical systems are validated against a fixed network configuration, and in finance, where inter-bank links are governed by bilateral agreements that specify the equipment on both ends.
What a sidecar changes
A sidecar is an appliance that sits beside the existing edge device rather than replacing it. The edge router keeps every routing decision, every address and every firewall rule. The sidecar receives traffic on one port, wraps it in a post-quantum layer, and hands it back. The existing IPsec tunnel then carries that protected traffic exactly as it carried the unprotected traffic before.
Three consequences follow.
The existing security is still there. Tessera adds a layer inside the tunnel rather than replacing the tunnel, so the outer IPsec protection the operator already trusts keeps working. If the post-quantum layer ever fails, traffic falls back to that IPsec with a visible alarm, never silently.
The change is contained. Nothing about the operator’s routing, addressing or certification changes. A site cutover is one short, planned step rather than a network redesign, which is why pilot sites have connected in days.
The trust model is explicit. Keys are generated and held on the two appliances at each end of a link, in a hardware-rooted secure enclave, and never leave them. The service that introduces the two ends to each other holds no secrets. Vendor-blindness is not a policy, it is a property of where the keys live.
Why this matters now
The mandates in the United States, the European Union, Saudi Arabia and France set dates between 2026 and 2030 by which critical-infrastructure operators must be running quantum-safe protection. An approach that waits for every edge device to be replaced will not meet those dates. An approach that adds protection beside the devices already in place can.