Post-quantum on the MCU. Below the OS line.

Most IoT and embedded devices run lightweight versions of Linux or RTOS variants with publicly documented vulnerability histories. An adversary exploiting an OS-layer CVE on an industrial IoT gateway gains full control of the device, its cryptographic keys, and all communications it handles. An OS-free device running bare-metal protocol firmware has no OS vulnerability class — there is no operating system to exploit, no kernel to privilege-escalate through, and no shell to drop into.

An adversary who can reach the firmware update mechanism of an embedded device can force a rollback to a version with known vulnerabilities — even if the device has been fully patched. Firmware downgrade attacks are documented against industrial PLCs, smart meters, and gateway devices. A cryptographically authenticated update chain with version floor enforcement prevents rollback regardless of adversary network access to the update channel.

Conventional firmware update systems connect devices to update servers in a way that reveals fleet composition to any observer monitoring the update traffic — device count, model types, geographic distribution, and current version status. Adversaries monitoring OTA update events can enumerate critical infrastructure IoT fleets, identify vulnerable devices by version, and locate them geographically before an attack. The update event is a reconnaissance opportunity.

Industrial sensor data — power grid load patterns, water treatment parameters, pipeline pressure readings, environmental monitoring — reveals operational patterns with intelligence value over extended time horizons. Adversaries are archiving this sensor telemetry today for retroactive quantum decryption. Post-quantum protection on sensor data is not a future consideration — the archive is being built now, and the sensitivity window for infrastructure operational patterns extends decades.

Microcontrollers and embedded processors sourced from foreign supply chains may contain silicon-level implants that operate below the firmware layer — beyond the reach of any software security audit or firmware verification mechanism. An implanted MCU can extract cryptographic keys, suppress tamper detection, or provide a covert channel regardless of what software runs on top of it. Sovereign supply chain hardware is the only answer at the silicon level.