14 min read
Most businesses are not using quantum computers today, but they may already have a quantum security problem. The encryption protecting websites, cloud services, financial transactions, digital identities and sensitive company information was largely designed for conventional computers. A sufficiently powerful quantum computer could eventually break some of the public-key cryptography organizations currently depend on.
That is why post-quantum cryptography is moving from a research topic into a practical cybersecurity priority. Organizations do not need to wait for a cryptographically relevant quantum computer to appear before acting. NIST has already finalized three major post-quantum cryptography standards and says organizations should begin applying them now. Its current transition planning expects quantum-vulnerable algorithms to be removed from NIST standards by 2035, with higher-risk systems moving earlier.
The challenge is much larger than replacing one encryption algorithm. Cryptography is embedded throughout modern IT infrastructure, applications, certificates, APIs, networks, devices and cloud services. Businesses first need to understand where vulnerable cryptography exists, how long the protected information must remain confidential and which systems should be migrated first.
Why Today’s Encryption Could Become Vulnerable
Modern digital security relies heavily on mathematical problems that conventional computers find extremely difficult to solve. Public-key cryptography is used for activities such as exchanging encryption keys, authenticating users, signing software and verifying digital identities.
Quantum computing changes the security assumptions behind some of those systems. A sufficiently capable quantum computer running the right algorithms could solve certain mathematical problems far more efficiently than today’s machines, threatening widely used public-key approaches.
This does not mean current encryption is suddenly broken. Cryptographically relevant quantum computers capable of attacking widely deployed public-key systems do not yet exist. The problem is that cybersecurity migrations take years, while valuable data may need protection for decades.
NIST specifically warns that organizations should begin migrating before large-scale quantum computers arrive because cybersecurity products, protocols and services will all require updates.
The Threat Can Begin Before Quantum Computers Are Ready
One of the reasons post-quantum security matters now is the possibility of attackers collecting encrypted information today and attempting to decrypt it later.
This is commonly described as a “harvest now, decrypt later” strategy. An attacker may capture encrypted communications or stored information that is currently unreadable. If powerful quantum computers eventually become available, previously collected information protected by vulnerable cryptography could potentially be decrypted.
This matters most for information with a long useful life. Intellectual property, government information, medical records, financial information, authentication infrastructure and sensitive corporate data may still be valuable years after they are created.
A company therefore cannot evaluate quantum risk only by asking when a powerful quantum computer will exist. It also needs to ask how long today’s information must remain confidential.
If data needs protection for ten or twenty years, waiting until the quantum threat fully arrives may be too late.
NIST Has Already Finalized Post-Quantum Standards
Post-quantum cryptography is no longer limited to experimental algorithms. NIST completed the first major phase of its standardization process in August 2024 by publishing three finalized standards designed to resist attacks from both conventional and future quantum computers.
FIPS 203 defines ML-KEM, a key-encapsulation mechanism used to establish shared secret keys. FIPS 204 defines ML-DSA, a lattice-based digital signature standard. FIPS 205 defines SLH-DSA, a stateless hash-based digital signature standard.
These standards followed years of public evaluation involving researchers, governments and industry experts from around the world. NIST continues evaluating additional algorithms so organizations are not dependent on a single mathematical approach.
The important point for businesses is that waiting for standards is no longer necessary. The first standards already exist and NIST is explicitly encouraging organizations to start transitioning.
Post-Quantum Cryptography Does Not Require a Quantum Computer
The name can create confusion. Post-quantum cryptography does not mean that organizations need quantum hardware to use it.
PQC algorithms run on conventional computers. They use mathematical problems designed to remain difficult for both classical and quantum computers.
That distinction makes migration practical. Businesses can begin deploying quantum-resistant cryptography across existing infrastructure long before quantum computers become powerful enough to threaten current systems.
The transition is therefore primarily a software, standards and infrastructure challenge rather than a requirement to purchase quantum hardware.
The Biggest Challenge Is Finding Where Cryptography Is Used
For large organizations, cryptography can be surprisingly difficult to inventory. Encryption and digital signatures may be embedded inside operating systems, web servers, APIs, certificates, VPNs, databases, mobile applications, authentication systems, software libraries and hardware devices.
Some cryptography may be managed directly by internal security teams. Other implementations may be hidden inside third-party applications or cloud services.
This makes discovery one of the first major steps in a PQC migration.
NIST’s National Cybersecurity Center of Excellence recommends that organizations understand where quantum-vulnerable public-key algorithms are being used across hardware, software and services before building migration roadmaps.
Without that inventory, businesses cannot reliably estimate their exposure or determine which systems need attention first.
Not Every System Needs to Move at the Same Time
Post-quantum migration should be prioritized according to risk rather than treating every system equally.
A public marketing website protecting low-sensitivity information may not deserve the same urgency as an identity system, certificate authority, financial platform or database containing information that must remain confidential for many years.
Organizations can prioritize systems based on several factors: the sensitivity of the data, how long the information must remain protected, how critical the system is to operations, whether cryptography is difficult to replace and how long migration is expected to take.
Systems with long data-retention requirements and high security consequences should generally receive attention earlier.
This risk-based approach makes migration more manageable because organizations can begin with their highest-value assets instead of attempting to change everything simultaneously.
Cryptographic Agility Is Becoming a Business Requirement
One of the broader lessons from the quantum transition is that businesses need cryptographic agility.
Cryptographic agility means designing systems so encryption algorithms, keys and cryptographic components can be changed without rebuilding the entire application or infrastructure.
Historically, organizations often treated cryptographic algorithms as long-term technical dependencies. An application might be designed around one certificate format or encryption library and remain unchanged for years.
That approach becomes risky when cryptographic standards need to change.
Post-quantum migration may not be the last major transition companies face. New vulnerabilities, standards and attack techniques can emerge over time. Systems that can replace algorithms quickly are better prepared for future changes.
Businesses should therefore treat PQC migration as an opportunity to improve how cryptography is managed rather than simply swapping one algorithm for another.
Hybrid Cryptography Can Help During the Transition
Large cryptographic migrations rarely happen overnight. Organizations may need to support traditional and post-quantum algorithms simultaneously while infrastructure, vendors and applications are updated.
Hybrid cryptographic approaches can help during this transition.
A hybrid system combines classical cryptography with post-quantum algorithms so security does not depend entirely on one approach. If one component later proves weaker than expected, the other still contributes protection.
NIST’s 2026 working drafts for updating Personal Identity Verification systems describe a dual-stack approach that preserves existing classical credentials while adding post-quantum mechanisms such as ML-KEM and ML-DSA. The goal is to support backward compatibility and gradual migration rather than forcing an immediate replacement of every existing component.
Businesses may follow similar principles depending on their infrastructure and vendor support.
Software Vendors Will Play a Major Role
Most organizations do not directly implement every cryptographic algorithm they use. They depend on operating systems, cloud providers, networking equipment, security products, development frameworks and SaaS applications.
That means vendor readiness will significantly influence PQC migration.
Security and IT teams should begin asking vendors which post-quantum standards they plan to support, when upgrades will become available and whether existing hardware or software can be updated.
Long-lifecycle systems deserve particular attention. Hardware deployed today may still be operating a decade from now. If it cannot support new cryptography, replacing it later may become expensive or disruptive.
PQC readiness should increasingly become part of procurement and architecture decisions.
Organizations buying long-term infrastructure today should consider whether that infrastructure can adapt to the cryptographic requirements of the future.
Digital Signatures Are Part of the Quantum Problem
Discussions about quantum cybersecurity often focus on encrypted communication, but digital signatures are equally important.
Digital signatures verify software updates, documents, certificates, transactions and identities. If a future quantum computer could forge signatures based on vulnerable algorithms, attackers could potentially impersonate trusted systems or create malicious software that appears legitimate.
This is why NIST standardized both key-establishment and digital-signature algorithms.
ML-DSA and SLH-DSA provide quantum-resistant digital signature options, while NIST continues evaluating additional signature algorithms as potential alternatives and backups.
Organizations should therefore inventory both encryption and signing systems during PQC planning.
AI Is Now Affecting Post-Quantum Cryptography Research
An interesting 2026 development shows how quickly cryptography research itself is evolving.
In July 2026, Anthropic reported that an AI model identified a mathematical vulnerability in HAWK, a lattice-based digital-signature algorithm that had been under consideration in NIST’s additional signature standardization process. The HAWK development team subsequently withdrew the algorithm. NIST says the discovery does not affect its finalized standards such as ML-KEM or ML-DSA, which rely on different constructions.
The episode demonstrates why cryptographic algorithms undergo years of public analysis before widespread deployment.
It also shows a new role for artificial intelligence. AI systems may increasingly assist researchers in finding weaknesses in cryptographic designs, generating mathematical analysis and strengthening security evaluation.
Rather than making PQC less trustworthy, discoveries during the evaluation process demonstrate why open testing and multiple backup algorithms are important.
Businesses Should Avoid Waiting for a Precise Quantum Deadline
No one can confidently predict the exact date when a quantum computer capable of breaking major public-key cryptography will become available.
That uncertainty sometimes causes organizations to delay action.
But cybersecurity planning rarely works well when everyone waits until the threat becomes immediate.
Migration requires inventory work, software changes, testing, vendor coordination, compliance updates and potentially hardware replacement. Large enterprises may need years to transition complicated systems.
NIST’s current guidance therefore focuses on migration now rather than trying to predict the precise arrival date of a cryptographically relevant quantum computer.
The important question is not “Will quantum computers break encryption next year?” It is “How long would our organization need to replace vulnerable cryptography if the threat became urgent?”
For some companies, the answer may be several years.
Start With a Cryptographic Inventory
The most practical first step is understanding the organization’s existing cryptographic footprint.
Security teams should identify where public-key encryption, key exchange and digital signatures are being used. This includes applications, APIs, websites, certificates, authentication systems, VPNs, cloud infrastructure, devices and third-party products.
The inventory should also record which algorithms are being used, who owns the system, how difficult the cryptography is to change and how long the information being protected must remain secure.
NIST specifically recommends inventorying systems that rely on vulnerable encryption as part of preparing for post-quantum migration.
Once the organization has visibility, it can begin prioritizing systems rather than treating PQC as an abstract future issue.
Identify Data With Long Confidentiality Requirements
The next step is understanding which information would still create serious consequences if it were exposed many years from now.
Some business information loses value quickly. Other information remains sensitive for decades.
Trade secrets, research, customer identities, healthcare records, long-term contracts, financial information and security credentials may have much longer confidentiality requirements than routine operational data.
This analysis helps organizations understand their exposure to harvest-now-decrypt-later attacks.
The longer the information must remain private, the earlier migration should be considered.
Build a Phased PQC Migration Roadmap
A realistic migration plan should be phased.
The first phase can focus on discovery and risk assessment. The next can include testing post-quantum algorithms in controlled environments and identifying vendor dependencies. High-risk systems can then begin transitioning while lower-risk applications follow over time.
Organizations should avoid attempting a large, simultaneous cryptographic replacement without testing. New algorithms may have different key sizes, performance characteristics and compatibility requirements.
Applications, network protocols and devices need to be tested under realistic workloads.
The goal is not simply to become quantum-safe as quickly as possible. It is to become quantum-safe without introducing new operational or security problems during the transition.
Test Performance Before Large-Scale Deployment
Post-quantum algorithms can have different computational, bandwidth and storage requirements compared with traditional cryptography.
Larger keys, signatures or certificates may affect performance in systems that operate under strict latency, memory or bandwidth constraints.
This does not prevent adoption, but organizations need realistic testing.
Web applications, IoT devices, embedded systems, APIs and high-volume transaction platforms can all respond differently to cryptographic changes.
Testing should therefore include performance, interoperability, certificate management, failure handling and compatibility with older systems.
A technically secure algorithm still needs to function reliably inside the organization’s actual infrastructure.
Update Security Procurement Requirements
PQC planning should increasingly influence technology purchasing.
Organizations replacing network hardware, identity systems, security appliances or long-lived software should ask whether those products support quantum-resistant cryptography or provide a clear upgrade path.
This is particularly important for technology expected to remain deployed for many years.
Buying a system today that cannot adapt to new cryptographic standards could create an expensive replacement problem later.
PQC readiness can therefore become part of security questionnaires, vendor evaluations and procurement standards.
Post-Quantum Security Is a Long-Term Transformation
The shift toward post-quantum cryptography will not happen through a single software update. It is a long-term transformation of the security infrastructure that underpins digital communication.
Organizations will need to discover where cryptography is used, prioritize sensitive systems, coordinate with vendors, test new algorithms, update applications and develop more flexible cryptographic architectures.
The good news is that businesses no longer need to wait for the standards themselves. NIST has finalized the primary PQC standards and is actively telling organizations to begin implementation and migration planning now.
Quantum computers powerful enough to break current public-key cryptography may still be years away, but cybersecurity preparation needs to begin before the threat becomes immediate.
Companies that start building cryptographic inventories, improving crypto agility and testing quantum-resistant technologies today will have far more flexibility than organizations forced into an emergency migration later.
The quantum cybersecurity transition has already started. The businesses best prepared for it will be those that treat post-quantum security as an infrastructure strategy now rather than a problem to solve after quantum computing finally reaches its breakthrough moment.
Frequently Asked Questions
What is post-quantum cryptography?
Post-quantum cryptography refers to cryptographic algorithms designed to remain secure against attacks from both conventional computers and future quantum computers. These algorithms run on today’s hardware and do not require a quantum computer.
Why is post-quantum cryptography important?
Powerful future quantum computers could threaten some widely used public-key encryption and digital-signature systems. PQC provides replacement algorithms designed to resist those attacks.
Are quantum computers breaking encryption today?
No cryptographically relevant quantum computer capable of breaking widely deployed public-key cryptography is publicly known to exist today. Organizations are preparing early because large-scale cryptographic migrations take years.
What post-quantum standards has NIST finalized?
NIST finalized FIPS 203 for ML-KEM, FIPS 204 for ML-DSA and FIPS 205 for SLH-DSA in August 2024. These standards cover quantum-resistant key establishment and digital signatures.
What is quantum-safe encryption?
Quantum-safe or quantum-resistant encryption refers to cryptographic systems designed to remain secure even if attackers gain access to sufficiently capable quantum computers.
What is a harvest-now-decrypt-later attack?
It describes an attacker collecting encrypted information today with the intention of decrypting it in the future after more powerful computing technology becomes available.
When should businesses begin migrating to PQC?
NIST recommends organizations begin applying its finalized standards and planning migration now rather than waiting for quantum computers capable of breaking current cryptography.
What is cryptographic agility?
Cryptographic agility is the ability to replace or update encryption algorithms and cryptographic components without redesigning an entire system. It can make future security migrations faster and less disruptive.
Will businesses need to replace all existing encryption immediately?
No. Migration can be prioritized according to risk, data sensitivity, system lifetime and vendor readiness. High-risk systems and information requiring long-term confidentiality generally deserve earlier attention.
Is post-quantum cryptography only relevant to large enterprises?
No. Any organization that depends on encrypted communication, digital signatures, certificates, customer information or long-lived sensitive data may eventually be affected by the transition to quantum-resistant security.
