Post-quantum security can’t wait for Q-Day, writes Andy Leaver, CEO of Arqit.
Recent government action has made it clear that quantum computing is no longer a distant research project. From the United States Government’s Executive Orders urging acceleration to commercially viable machines, to new framework announcements in the UK and France, recognition is growing of its impending commercialisation and the consequences it will have.
While the conversation continues to focus on shortening of forecasts of when Q-Day will arrive, that’s increasingly becoming the wrong area of focus for governments and enterprises. Migrating to post-quantum cryptography ecosystems will take years, not months. Indeed, migrating an entire cryptographic estate is more complex than just a straightforward algorithm swap, meaning many organisations are already left with less time than they think.
Boards need to resist treating quantum as tomorrow’s problem. The growing debate around timelines risks distracting organisations from a much more immediate concern when it comes to sensitive data already being harvested today, that could be decrypted when quantum capabilities arrive. What many enterprises will not have considered, is that AI is making it easy and quick for adversaries to sift through collected data when that time does come, and the consequences will have repercussions throughout the business. No matter what information has been decrypted, trust in all other data throughout an enterprise will be swept away overnight.
Why breaking encryption can absolve trust
For long lived data – such as financial records, intellectual property or identity data – the risk doesn’t just begin when a quantum computer is able to break today’s encryption. The risk already exists through ‘harvest now, decrypt later’ attacks, where adversaries collect encrypted data today with the intention of decrypting it once sufficiently powerful and viable quantum computers become available. In fact, this exposure can only be closed once data is encrypted using PQC-safe technology.
Unfortunately, many businesses brush off this risk for one of two reasons. Some assume that even if encrypted data is being harvested, the sheer volume involved limits the threat. But what they might not have considered is the power of AI and quantum working together. AI has made it possible to sift through terabytes of data almost instantly, helping to identify high-value information at scale. And that’s exactly what bad actors will do once quantum is available to break the encryption.
Others assume they’re not at risk because they have little long-lived data worth stealing. Yet the impact of a compromise will extend beyond the exposed information itself. Once the integrity of data and digital signatures using vulnerable encryption is brought into question, confidence in the systems, contracts, transactions and even the intellectual property built on that data will quickly erode. At that point, the issue becomes a loss of trust in the entire digital ecosystem because encryption is used in practically all critical business processes.
Translating quantum risk for the boardroom
For many boards, quantum security still sounds like a specialist technology challenge. In reality, it’s a leadership one that touches governance, resilience, compliance and corporate accountability. The consequences extend as far as regulatory exposure, supplier risk, customer trust, operational resilience and ultimately, confidence in the data underpinning strategic decisions and AI models that many businesses are built on. If sensitive information can no longer be trusted, neither can the decisions, transactions or services built upon it.
As organisations invest heavily in AI and automation, trust in data has become a business asset in its own right.
That is why quantum readiness and resilience cannot sit solely with the CISO. Security teams play a critical role in identifying exposure and planning migration, but accountability for long-term resilience ultimately rests with leadership. Good governance means staying ahead of material risks before they become urgent. Delaying PQC migration is one of the most significant technology risks of the decade and boards that act now will be able to demonstrate exactly how important it will be to the future security of an enterprise.
Building a roadmap to PQC migration
One reason organisations and business leaders underestimate the challenge ahead is the assumption that quantum readiness simply means replacing one encryption algorithm for another. In reality, cryptographic systems are highly interconnected, meaning changing one component often has implications on dependencies across an enterprise’s trust chains..
Before any organisation can claim to be quantum ready, it must understand and have full visibility of its entire cryptographic estate. That includes where encryption is used, how systems interact and therefore which assets would be affected by change. Without that knowledge, it’s impossible to plan an effective migration strategy. While the journey to quantum readiness isn’t a quick one, the process delivers immediate value. Mapping cryptographic dependencies often reveals existing security weaknesses and governance gaps that organisations can and must address today. So in many cases, the work required to prepare for quantum threats also strengthens resilience against current ones, offering businesses ROI far quicker than many might expect.
Have you taken reasonable action?
Boards and CISOs already have no shortage of cyber priorities competing for attention. But the encouraging news is that getting started on PQC migration doesn’t mean replacing cryptographic systems overnight.
The first step is gaining visibility of the organisation’s cryptographic estate. Once businesses understand where cryptography exists, which systems depend on it and where their greatest risks lie, they can begin prioritising a realistic PQC migration plan.
That work delivers immediate value. We regularly see organisations uncovering existing governance gaps and unknown cryptographic dependencies that are exposing them to immediate security threats. The most important message is that preparation can’t wait. Organisations that act now to protect long-lived data and demonstrate good governance will be far better placed to show they took reasonable action while there was still time.
