Introduction

Quantum computing promises breakthroughs across industries. however, it also challenges the foundations of modern cyber security. Today, the protection of data, identities, and transactions relies on cryptographic algorithms that quantum computers are expected to weaken or even break.

Transitioning to post-quantum security is no longer a distant consideration, it is a strategic necessity that organisations must start addressing now.

Quantum Computation: The Advancement of a New Era

Why are quantum computers gaining so much relevance?

A quantum computer derives its computational advantage not from higher clock speeds or brute-force parallelism, but from its ability to exploit the principles of quantum mechanics in ways that have no classical equivalent. Unlike classical systems, which encode information in bits that are always either 0 or 1, quantum systems use qubits, i.e. units that can exist in a combination of both states simultaneously (superposition) and can be correlated with one another in ways that classical systems cannot replicate (entanglement). These properties allow quantum computers to explore vast solution spaces in ways that make certain problems (including breaking widely used cryptographic algorithms) dramatically easier to solve.

By applying carefully engineered unitary transformations, quantum algorithms orchestrate constructive and destructive interference, amplifying the amplitudes associated with correct solutions while suppressing incorrect ones.  For specific problem classes, such as integer factorisation (via Shor’s algorithm), unstructured search (via Grover’s algorithm), and quantum system simulation: this results in polynomial or even exponential reductions in computational complexity compared to the best known classical algorithms. Importantly, quantum computers do not provide universal speedups; rather, their advantage is problem-dependent and emerges only when an algorithm can map computational structure onto quantum interference in a way that reduces asymptotic complexity.

For businesses, this could mean faster optimisation, accelerated drug discovery, improved financial modelling, and more powerful artificial intelligence.

But there is another side to this progress. The same computational power could break widely used encryption schemes such as RSA and ECC, algorithms that currently secure websites, digital signatures, VPNs, and financial transactions.

Even if large scale quantum computers won’t be available for everyone, organisations relying on quantum-vulnerable cryptography are already exposed to future risk.

Post-Quantum Security: Rethink the Way You Are Protecting Yourself

What does post-quantum security actually mean for your organisation?

Post-Quantum Cryptography (PQC) focuses on developing algorithms capable of resisting both classical and quantum attacks. These new algorithms are designed to run on today’s systems, meaning companies do not need quantum computers to implement quantum-resistant protection. The objective is simple: ensure long-term confidentiality, integrity, and authentication, even in a post-quantum world.
A major threat already exists: “harvest now, decrypt later” attacks, where adversaries record encrypted traffic today with the intent of decrypting it once quantum computing capabilities mature. A serious risk for or long-lived sensitive information (intellectual property, financial records, state secrets).

The World’s Road to Crypto-Agility: A Race Against Time

How much time does your organisation really have to prepare?

Transitioning to post-quantum security is not just a technical upgrade, but a true organisational transformation. It is not simply about replacing existing algorithms with quantum-resistant ones. It requires rethinking how cryptography is identified, managed, monitored, and updated across the entire organisation.

Crypto agility is the ability to quickly replace cryptographic algorithms without rebuilding entire systems and it is precisely what organisations need to effectively respond to the challenges posed by post-quantum cryptography. Achieving crypto agility requires having a clear and complete view of a company's cryptographic assets, understanding where and how encryption is used, and being able to determine which components need to be updated or replaced as new standards and discoveries emerge.

The benefits go beyond security. A crypto-agile organisation can adapt more quickly to regulatory changes, new vulnerabilities, or technological shifts, often with lower costs and reduced operational disruption. When urgent action is required, crypto agility becomes a strategic advantage rather than a technical burden.

Driven by “harvest now, decrypt later” attacks, roadmaps and best practices are being developed: Institutions, governments and research bodies are defining quantum-resistant standards and outlining migration timelines.  

NIST has published in 2025 the first set of finalised post-quantum encryption standards [1](FIPS 203, FIPS 204, and FIPS 205) providing concrete, quantum-resistant replacements for classical asymmetric cryptographic schemes and marking a major milestone in securing digital infrastructure against future quantum threats.

These standards, based on lattice-based (ML-KEM and ML-DSA) and hash-based (SLH-DSA) primitives, are intended to be adopted immediately even as ongoing evaluation continues for additional PQC algorithms. At the same time, NIST’s long-term transition guidance projects that quantum-vulnerable public-key algorithms such as RSA, ECDSA, EdDSA, Diffie-Hellman, and ECDH will be formally deprecated by around 2030 and completely disallowed in standards by approximately 2035, creating a clear window for organisations to migrate to PQC solutions.

By contrast, symmetric primitives such as AES and SHA-based hash functions are not considered imminently at risk from quantum adversaries, since known quantum algorithms only yield a quadratic advantage against them, and appropriately increased key sizes (e.g., AES-256) are expected to maintain strong security in the quantum era.

[1] Ref: NIST Releases First 3 Finalised Post-Quantum Encryption Standards | NIST

Quantum Readiness Starts in the Boardroom

Turning Post Quantum Risk into a strategic advantage

What can be done to create a strategy?

PQC transition involves many aspects of a company, like risk management, regulatory compliance, long-term data protection, operational resilience and competitive positioning.

It is essential to engage your company’s board and frame post quantum readiness as a matter of enterprise risk and strategic governance, not as IT modernisation.

Once they see how exposed is your company against quantum threats, the board will be happy to prioritise action against the concrete exposure you are facing.

Identify where quantum-vulnerable cryptography is embedded in the organisation, assess the lifespan of the data to protect and evaluate the impact of “harvest now, decrypt later” scenarios are points that need full prioritisation.

External drivers, like standards and roadmaps issued by NIST, are a good way to show how much any company will be involved.

But full migration will require years of planning, testing, vendor coordination, and budget allocation: without a quick reaction to the inputs, even the traced timelines might not be enough.

Organisations that move early will reduce migration shock, spread costs over time, strengthen regulatory positioning, and demonstrate technological leadership.

The quantum era is approaching on its own timeline. The only variable your company controls is whether it reacts under pressure or leads with foresight. The right conversation with the board today determines which path you take.

Conclusion

Post-quantum security is not about fear, it is about foresight.

Quantum computing will unlock innovation across industries, but it will also redefine how we secure our digital world. It is not if the transition will happen, but when.

Organisations that build crypto-agility, assess their exposure, and begin their PQC journey today will be better positioned tomorrow.

Waiting is the real risk.

Is your organisation ready for the quantum era?

Authors:

Alberto Paganini

Lisa Orme