The cybersecurity landscape is rapidly shifting due to a risk that’s quietly brewing in the background: the race to achieve a cryptographically relevant quantum computer, also known as CRQC (but we’ll call it a quantum computer for simplicity). Quantum computing has long promised to redefine what’s possible in technology, with its ability to solve complex problems exponentially faster than classical computers. But it’s often been dismissed as a problem that is too far away to worry about. That’s changing. What once felt like a distant risk is now accelerating toward reality, and one of the driving forces in this decade has been AI.
Speeding up quantum development
With the convergence of AI and Quantum Computing, the industry is leveraging AI to accelerate the viability of Quantum Computing. From dramatically improving quantum error correction to optimizing quantum algorithms, AI is reducing some of the key barriers to quantum computing. This means quantum computing, the point at which quantum systems can break today’s public key cryptography, could arrive sooner than the industry initially projected.
When quantum computing becomes viable, bad actors will be able to quickly and easily decrypt any data encrypted with today’s most secure cryptographic algorithms, across web, application, VPN, and more. This could lead to data loss at a scale never seen before.
To address this threat, over the last few years, security researchers have developed quantum-resistant encryption designed to keep data safe from attacks launched from both classic computers and future quantum computers. Becoming quantum-safe before quantum computers become a reality requires organizations to migrate existing encryption to post-quantum cryptography (PQC). Obviously, this needs to happen before quantum computing becomes a reality, but I'm often asked: how urgent is this?
Why Post-Quantum Cryptography (PQC) Can’t Wait
With AI-powered quantum advancements, the timeline for quantum threats could be closer than anticipated. Even if quantum computers aren’t here today, the risks are.
The first consideration is that it takes a long time to get your enterprise quantum ready, several years in many cases. In a given enterprise, there may be thousands of internally developed and third party applications, numerous operating systems, dozens of different types of network infrastructure equipment, and countless IoT and OT devices. All of these leverage public key cryptography to keep data and communications safe, so all of them need to be migrated to PQCs. Needless to say, replacing cryptography across a global IT ecosystem is not a flip-of-the-switch effort. It will require years of planning, testing, and deployment.
The next thing to consider is ‘Harvest Now, Decrypt Later’ attacks – where bad actors exfiltrate encrypted files now in anticipation of being able to decrypt them when quantum computing becomes available. This presents an immediate risk for financial institutions, health care organizations, government agencies and other industries who need to keep their data private for long periods of time. If your organization deals with any sensitive data – the kind that has personally identifiable information and/or needs to stay protected for a long time – then you are already at risk and should be taking action.
This means quantum risk isn’t a future problem. It’s a now problem.
What you should do now to future-proof investments
1. Plan ahead: Start by taking a Cryptography Inventory to discover what cryptography you’re using and where. Most organizations don’t have a clear map of all the cryptographic suites in their software, devices, and infrastructure. This visibility is the foundation for any PQC strategy. This is definitely the most challenging and time-consuming stage of planning to successfully inventory all systems and have a comprehensive cryptography view of your infrastructure. You’ll want to then prioritize the threats based on the most insecure cryptography being used, your electronic communications that go over public internet, and the most pressing data you need to secure. Remember, any data can be harvested now.
2. Upgrade Your Network: The easiest and fastest path to becoming quantum-ready is to upgrade your core infrastructure. Focus on essentials like your VPNs, which protect data moving between your offices and for your remote workers. This provides an immediate and significant security boost. For older, legacy applications that can't be easily updated, you can use translation proxies. Think of these as a modern security guard for an old building; by properly isolating the application and placing a proxy in front of it, you can instantly make it quantum-safe without needing to change the application's code. This is a powerful way to help protect critical systems while you plan for longer-term solutions.
3. Upgrade your apps: Your company is likely using a lot of applications to do business, including ones you’ve built and bought thorough commercial and open source software. By adopting PQC libraries
for your private apps and upgrading or reconfiguring commercial software and SaaS applications to use PQCs, you can do a lot to become more quantum safe. When it’s not possible to upgrade, plan to segment the apps behind a Quantum-safe proxy. Also be sure to stay engaged with your SaaS & Commercial app providers to understand their timeline to update to PQC.
Finally, you must remember to stay agile. Industry guidance for PQCs could evolve as newer use cases and challenges with efficacy and industry impact are better understood. This is why I recommend that every company should adopt cryptographic agility by ensuring your systems can easily swap algorithms and security levels as standards evolve.
None of this will be easy or simple – which is why it’s important to start now. The best thing you can do is make this part of your IT modernization efforts, regularly investing in it as part of your ongoing security hygiene. Starting early can prevent a rush to implementation, helping ensure quality remains high and costs remain predictable and manageable. Also you should start asking your vendors for their quantum-safe plans so that you can better understand what cryptography is used and whether your company’s data is in the right hands.
The Bottom Line
Quantum computing may not be a day-to-day concern for most organizations yet – but waiting until it is will be too late. With AI accelerating the timeline and data already at risk, now is the time to future-proof your investments. Start your journey to becoming quantum safe today by building a roadmap that accounts for inventory, agility, and infrastructure.
The organizations that act now will not only be ready for quantum computing – they’ll be safer, more resilient, and better equipped to navigate the complex cryptographic landscape of the future
