QUANTUM SECURITY WHITE PAPER

The Quantum Threat to Encryption: From Theory to Operational Reality

Why Boards Must Act Before Quantum Computing Breaks the Cryptographic Foundation of Every Organisation

CyberCQR Research Paper | March 2026 | 40 minutes reading time

Critical Insight

The encryption protecting your organisation’s data today — SSL/TLS, RSA, elliptic curve cryptography — relies on mathematical problems that classical computers cannot solve in any reasonable timeframe. A sufficiently powerful quantum computer breaks this assumption entirely.

Nation-state actors are already harvesting encrypted data today under a strategy known as “Harvest Now, Decrypt Later.” The quantum threat is not a future problem. The attack has already begun.

Executive Summary

Quantum computing represents both the most significant cryptographic risk in modern history and a transformational opportunity for organisations that prepare early. This paper addresses three questions boards must answer:

When does the quantum threat become real? The timeline is shorter than most organisations assume.
What is at risk? Every encrypted communication, stored credential, digital signature, and PKI certificate.
What must organisations do now? Post-quantum cryptography migration is a multi-year programme that must begin immediately.

NIST finalised the first post-quantum cryptography (PQC) standards in August 2024. Regulatory bodies including the FCA, NCSC, and ENISA are issuing guidance. Organisations that treat this as a distant technical concern will face the same outcome as those that delayed GDPR compliance — except the consequences are existential rather than financial.

Key Findings

NIST PQC Standards (2024): Three post-quantum algorithms standardised — ML-KEM, ML-DSA, and SLH-DSA — with migration guidance now available
Harvest Now, Decrypt Later: Intelligence assessments confirm nation-state actors are intercepting and storing encrypted data today for future quantum decryption
Timeline: Cryptographically Relevant Quantum Computers (CRQCs) projected within 10-15 years by most assessments; some estimate as few as 5-7 years
Migration Complexity: Organisations with significant PKI infrastructure require 5-10 years to complete full PQC migration — meaning the window for starting has already narrowed
Opportunity: Organisations completing PQC migration gain cryptographic agility, reduced technical debt, and demonstrable security leadership with regulators and clients

Part 1: Understanding the Quantum Cryptographic Threat

How Modern Encryption Works — and Why Quantum Breaks It

The security of virtually all internet communications, financial transactions, and stored sensitive data rests on a deceptively simple mathematical insight: certain computations are easy to perform but practically impossible to reverse.

RSA encryption, for example, relies on the fact that multiplying two large prime numbers together takes milliseconds, but factoring the result back into its prime components would take a classical computer longer than the age of the universe. Elliptic curve cryptography relies on a similar asymmetry. These problems are the bedrock of:

TLS/HTTPS (every secure web connection)
Email encryption (S/MIME, PGP)
VPN tunnels and remote access
Digital signatures and code signing
PKI infrastructure and certificate authorities
SSH keys and privileged access management
Cryptocurrency and blockchain systems
Banking and payment systems

Shor’s Algorithm: The Quantum Cryptographic Weapon

In 1994, mathematician Peter Shor demonstrated that a quantum computer could solve the prime factorisation problem exponentially faster than any classical computer. A problem that would take a classical computer millions of years could be solved by a sufficiently powerful quantum computer in hours.

Grover’s Algorithm, also quantum-native, halves the effective key length of symmetric encryption (AES-128 becomes effectively AES-64). In practice Grover’s algorithm parallelises poorly, so NIST and the NCSC still regard AES-128 as acceptable; AES-256 gives a comfortable margin. The urgent problem is public-key cryptography, not symmetric encryption.

What Is a Cryptographically Relevant Quantum Computer?

Current quantum computers — including those from IBM, Google, and IonQ — have hundreds to thousands of “noisy” qubits. The most recent published estimate (Gidney, 2025) is that RSA-2048 could be broken in under a week by a machine with fewer than one million noisy physical qubits, down from about 20 million in the 2019 estimate. No machine anywhere near that size exists yet, but the estimates keep falling.

Quantum Capability Milestones

Milestone	Status	Cryptographic Impact
100-1,000 noisy qubits	Achieved (2024)	None — insufficient for cryptographic attacks
10,000+ error-corrected qubits	~5-10 years	Breaks smaller RSA keys; threatens legacy systems
Cryptographically Relevant Quantum Computer	~10-15 years	Breaks RSA-2048, ECC-256; all current PKI at risk
Nation-state quantum advantage	Unknown (classified)	Asymmetric intelligence advantage; assume earlier

The Critical Planning Insight: If your organisation’s sensitive data must remain confidential for 10+ years, and if quantum computers arrive in 10-15 years, and if your PQC migration requires 5-10 years — you needed to start planning yesterday.

Part 2: The Immediate Threat — Harvest Now, Decrypt Later

Why the Quantum Threat Is Already Active

The most dangerous aspect of the quantum threat is that it does not require quantum computers to exist today to begin causing harm. Nation-state actors — primarily assessed to include China, Russia, and North Korea — are operating under a strategic doctrine: collect encrypted data now, decrypt it when quantum capability arrives.

This strategy is rational, economical, and already underway. The NSA, GCHQ, and CISA have all acknowledged this threat vector in public guidance documents.

What Data Is Being Harvested?

Adversaries are targeting data with long-term sensitivity value:

Government and defence communications — classified material with decades-long sensitivity
Intellectual property — R&D data, patent applications, proprietary formulas and designs
Financial intelligence — M&A planning, strategic investment data, client portfolios
Healthcare records — patient data with lifetime sensitivity and high value for blackmail/fraud
Legal and regulatory communications — litigation strategies, compliance documentation
Authentication credentials and certificates — private keys that will remain valid if not rotated

The Attacker’s Economics

Cost of collection: Storage is cheap. Intercepting encrypted internet traffic at scale requires infrastructure investment, but nation-states have already built this capability (as confirmed by Snowden disclosures and subsequent intelligence reporting).

Value at decryption: A single decrypted diplomatic cable, M&A negotiation, or pharmaceutical R&D file could be worth billions. The return on investment for patient adversaries is extraordinary.

Risk to attacker: Collecting encrypted data that cannot currently be read carries almost no legal or operational risk — it looks like legitimate internet traffic monitoring.

Which Organisations Are Most at Risk?

Immediate High Risk

Defence contractors and supply chain
Pharmaceutical and biotech R&D
Financial services (M&A advisory, investment banking)
Critical national infrastructure
Legal firms with sensitive client matters
Government and public sector

Medium-Term Risk

All organisations handling personal data (GDPR obligations persist)
Technology companies with IP portfolios
Healthcare providers with long-retention records
Professional services firms
Any organisation with sensitive client data
Supply chain partners to high-risk sectors

Part 3: The Regulatory and Standards Landscape

NIST Post-Quantum Cryptography Standards (August 2024)

After an eight-year competition and evaluation process, NIST published three finalised post-quantum cryptography standards in August 2024. These represent the global baseline for PQC migration:

FIPS 203 — ML-KEM (Module-Lattice Key Encapsulation Mechanism)

Replaces: RSA and ECDH for key exchange and encryption. Primary algorithm for protecting data in transit. The most immediately deployable standard — already supported in TLS 1.3 implementations.

FIPS 204 — ML-DSA (Module-Lattice Digital Signature Algorithm)

Replaces: RSA and ECDSA for digital signatures. Critical for code signing, document authentication, and certificate issuance. Affects every PKI certificate chain.

FIPS 205 — SLH-DSA (Stateless Hash-Based Digital Signature Algorithm)

Role: Conservative backup signature algorithm based on different mathematical principles. Slower and larger than ML-DSA but provides diversity if lattice-based approaches are later compromised. Recommended for high-security, low-frequency signing operations.

UK and European Regulatory Guidance

Body	Guidance / Requirement	Timeline
NCSC (UK)	Migration timelines published March 2025; endorses the NIST standards	Discovery and plan by 2028; priority migration by 2031; complete by 2035
ENISA (EU)	Post-quantum cryptography integration study; NIS2 Directive compliance will increasingly incorporate PQC requirements	NIS2 in force Oct 2024; PQC requirements emerging
FCA (UK)	No PQC-specific rules; operational resilience requirements (PS21/3) apply to cryptographic dependencies	Operational resilience rules in force since March 2025
DORA (EU)	ICT risk management requirements for financial entities include cryptographic controls; PQC will become a compliance expectation	In force Jan 2025; cryptographic requirements evolving
NSA (US)	CNSA 2.0 sets PQC deadlines for National Security Systems, with the first categories from 2025-2030; strongest signal of urgency from any major intelligence agency	All National Security Systems by 2035

Part 4: Organisational Exposure — What Is Actually at Risk

The Cryptographic Attack Surface

Most organisations have no clear picture of where cryptography is used across their estate. This is the first and most fundamental problem — you cannot migrate what you have not inventoried.

Where Vulnerable Cryptography Lives in Your Organisation

Network and Communications

TLS certificates (web, API, internal services) — typically RSA-2048 or ECC-256
VPN tunnels (IPSec, SSL VPN) — RSA or ECC key exchange
SSH host keys and user authentication keys
Email encryption (S/MIME certificates, PGP keys)
Wi-Fi authentication (EAP-TLS certificates)

Identity and Access Management

PKI certificate authorities and issued certificates
SAML and OAuth signing keys
Kerberos ticket-granting service keys (Active Directory)
Hardware security modules (HSMs) — may require physical replacement
Smart card and PIV credentials

Application and Data Layer

Database encryption keys and TDE configurations
Application-layer encryption (at-rest data protection)
Code signing certificates (software distribution, firmware updates)
Document and contract signing systems
Backup encryption keys — potentially the longest-lived vulnerability

Third-Party and Supply Chain

SaaS platforms used for sensitive data (your migration plan only covers what you control)
Payment processing integrations
IoT and operational technology devices — often with hard-coded cryptography impossible to update remotely
Industrial control systems with decade-long operational lifespans

The IoT and OT Problem

Industrial control systems, medical devices, and IoT infrastructure present a unique challenge: many devices cannot be remotely updated, have no vendor support for PQC, or have operational lifespans extending to 2035 and beyond. Organisations in manufacturing, healthcare, energy, and critical infrastructure face a category of exposure that cannot be solved by software patching alone. Hardware replacement programmes for long-life devices must begin now.

Data Classification and Sensitivity Horizons

The quantum risk is not uniform across all data. The relevant question is: how long must this data remain confidential?

Data Category	Sensitivity Horizon	Harvest Risk Level	Priority
R&D, patents, trade secrets	20+ years	Critical	Immediate
Healthcare / patient records	Lifetime (75+ years)	Critical	Immediate
M&A and strategic planning	5-15 years	High	High
Legal and regulatory files	10-30 years	High	High
Financial records	7-10 years (regulatory)	Medium	Medium
Operational communications	1-5 years	Lower	Standard migration

Part 5: The Post-Quantum Cryptography Migration Journey

Why Migration Is Harder Than It Sounds

PQC migration is often compared to the Y2K remediation effort in scope, but with higher technical complexity and a less defined deadline. Several factors make it genuinely challenging:

Cryptography is embedded everywhere. Unlike a software application, cryptographic dependencies exist across every layer of the technology stack, often without documentation.
Performance trade-offs are real. PQC algorithms have larger key sizes and signatures than their classical equivalents. An ML-KEM-768 public key is about 1.2 KB, several times an RSA-2048 key and far larger than the elliptic-curve keys used in most TLS today; ML-DSA signatures are tens of times larger than ECDSA signatures. Network and application infrastructure must be tested and capacity-planned accordingly.
Hardware constraints exist. HSMs, smart cards, and embedded devices may require physical replacement. Vendor timelines for PQC-capable hardware vary significantly.
Third-party dependencies. Your PQC readiness is only as good as your weakest supplier. Vendor questionnaires and contractual commitments must be part of the programme.
Standards are still maturing. While FIPS 203/204/205 are finalised, additional standards are in development. Migration must accommodate future algorithm agility.

The Four-Phase Migration Framework

Phase 1: Discovery and Inventory (Months 1-6)

Conduct comprehensive cryptographic asset inventory across all systems, applications, and third parties. Identify algorithm types, key sizes, certificate lifetimes, and ownership. Classify by data sensitivity and migration urgency. This phase is foundational — migration cannot proceed without it.

Phase 2: Prioritisation and Planning (Months 4-9)

Risk-rank all cryptographic assets. Build migration roadmap prioritising high-sensitivity, long-horizon data. Assess vendor and supplier PQC readiness. Begin hybrid classical/PQC deployments for highest-priority systems — hybrid mode provides quantum protection immediately without abandoning classical compatibility.

Phase 3: Migration Execution (Years 1-5)

Systematic replacement of classical cryptography with PQC equivalents, beginning with highest-risk systems. PKI infrastructure rebuilding, certificate replacement, application testing, and performance validation. Continuous tracking against inventory. HSM and hardware replacement programme where applicable.

Phase 4: Cryptographic Agility and Governance (Ongoing)

Establish processes to monitor algorithm standardisation developments and respond to new vulnerabilities. Build cryptographic agility into architecture — the ability to swap algorithms without system redesign. Maintain cryptographic inventory as a living document. Integrate PQC requirements into procurement and third-party due diligence.

Hybrid Classical/PQC: The Pragmatic Transition Approach

The NCSC and most standards bodies recommend a hybrid approach during the transition period: running classical and post-quantum algorithms together. A hybrid TLS handshake, for example, requires an attacker to break both ECDH and ML-KEM simultaneously — providing quantum protection today while maintaining compatibility with systems that have not yet migrated.

Practical Note: Major software vendors are already deploying hybrid PQC. Google began deploying hybrid post-quantum key exchange in Chrome in 2023 and moved it to the standardised ML-KEM in late 2024. Cloudflare and AWS have hybrid PQC capabilities available. Microsoft is integrating PQC into Azure and M365. Organisations on current software versions can begin hybrid deployments immediately for public-facing systems.

Part 6: The Opportunities — Competitive and Strategic Advantage

Not all aspects of quantum computing represent threats. Organisations that engage strategically with the quantum transition can gain meaningful competitive advantages.

Opportunity 1: Cryptographic Agility as a Differentiator

Organisations that build cryptographic agility into their architecture — the ability to replace algorithms rapidly — will be structurally better prepared for all future cryptographic challenges, not just quantum. This reduces long-term technical debt and improves overall security posture. For financial services, professional services, and technology firms, demonstrable cryptographic agility becomes a differentiator in client due diligence and procurement processes.

Opportunity 2: Regulatory Early Mover Advantage

Regulatory guidance on PQC is in its early stages. Organisations that engage with NCSC, FCA, and sector regulators proactively — demonstrating PQC roadmaps and early implementation — will shape the regulatory conversation rather than respond to mandates. Regulators consistently reward visible engagement with emerging security standards.

Opportunity 3: Client and Supply Chain Confidence

As quantum awareness grows among sophisticated enterprise clients, PQC readiness will become a procurement requirement in regulated sectors. The organisations best positioned to respond to “what is your PQC migration status?” in client due diligence questionnaires will win competitive advantages in financial services, healthcare, defence supply chain, and professional services engagements.

Opportunity 4: Quantum-Enhanced Security Capabilities

Quantum Key Distribution (QKD) — using quantum physics rather than mathematical complexity to secure communications — offers theoretically unbreakable encryption for high-value point-to-point links. While currently expensive and infrastructure-intensive, QKD costs are falling. Early adoption for the highest-value communication links (board communications, M&A negotiations, R&D data transfer) provides genuine security advantages and positions organisations ahead of wider adoption. Note that the NCSC does not currently endorse QKD for government or military use and recommends post-quantum cryptography as the main defence, so QKD is a specialist option rather than a general recommendation.

Part 7: Board-Level Guidance and Recommended Actions

Questions Boards Should Ask Management

Inventory: “Do we have a complete cryptographic asset inventory? Do we know every system using RSA or ECC cryptography?”
Data Classification: “Which of our data assets have sensitivity horizons extending beyond 10 years? Is this data currently encrypted with quantum-vulnerable algorithms?”
Harvest Risk: “What sensitive communications or data transfers occurred over the past 5 years that, if decrypted in future, would cause material harm?”
Migration Readiness: “Do we have a PQC migration roadmap? Who owns it? What is the budget and timeline?”
Third Party: “Have we assessed our key suppliers and SaaS providers for PQC readiness? Are there contractual commitments in place?”
IoT/OT: “Do we have operational technology or IoT devices with hard-coded cryptography that cannot be remotely updated?”
Insurance: “Does our cyber insurance cover quantum-enabled data breaches, including Harvest Now, Decrypt Later scenarios?”
Regulatory: “Are we engaged with our sector regulator on PQC expectations? Are we tracking NCSC and ENISA guidance?”

Fiduciary Duty Considerations

Boards have a duty to oversee material risks. The quantum cryptographic threat meets materiality thresholds for organisations in regulated sectors, with significant IP portfolios, or handling long-retention sensitive data:

Regulatory Obligation: GDPR, DORA, and the NIS2 Directive create obligations around “appropriate technical measures” — PQC readiness is becoming a component of this standard
NCSC Guidance: UK government has published explicit PQC migration guidance; boards in regulated sectors have implicit obligations to follow it
Disclosure Risk: A future quantum-enabled breach of historically collected data creates disclosure obligations under breach notification requirements — even for data collected years earlier
D&O Liability: Boards that fail to address known material risks face increasing scrutiny; quantum threat awareness is now sufficiently mainstream that “we did not know” will be an insufficient defence

Recommended Board Actions

Now (the NCSC expects discovery to be complete by 2028)

Commission cryptographic asset inventory from CISO or external advisor
Classify data assets by sensitivity horizon and quantum risk level
Request management briefing on current cryptographic standards in use
Verify cyber insurance coverage includes quantum-related breach scenarios

Within the next 12 months

Approve PQC migration roadmap with budget and ownership
Initiate hybrid PQC deployment for highest-priority external-facing systems
Issue supplier and SaaS vendor PQC readiness questionnaires
Engage sector regulator proactively on PQC expectations

2027-2030

Execute phased migration per approved roadmap
Require PQC readiness confirmation in vendor contracts at renewal
Establish cryptographic agility as an architectural standard
Review and update quantum risk assessment annually

Part 8: Economic Analysis — The Cost of Action vs. Inaction

Modelled Cost Comparison: PQC Migration vs. Post-Quantum Breach

Organisation Profile: GBP 500M revenue professional services firm, significant IP portfolio, 1,500 employees

Scenario A: Proactive PQC Migration (2026-2031)

Cryptographic inventory and assessment: GBP 75K
PQC architecture design and planning: GBP 150K
Migration execution (PKI, certificates, applications): GBP 500K
Hardware replacement (HSMs, IoT): GBP 250K
Ongoing cryptographic governance (annual): GBP 100K
5-year total: GBP 1.475M

Outcome: Quantum-resilient by 2031; regulatory leading position; competitive differentiator; historical data remains protected.

Scenario B: No Action — Quantum Breach in 2033

IP decrypted and sold to competitor: GBP 50-200M lost revenue impact (conservative)
GDPR breach notification and investigation: GBP 5-20M regulatory exposure
Client notification, legal costs, reputation management: GBP 15-40M
Emergency PQC migration (crisis pace, 3x normal cost): GBP 4.5M
Client attrition (10-20% over 3 years): GBP 15-30M revenue impact
Estimated total impact: GBP 90-295M

Conservative ROI: GBP 90M risk avoided / GBP 1.475M investment = about 61 times the investment (modelled)

Even at the most conservative breach estimate, proactive migration delivers extraordinary financial return on investment.

Conclusion: The Window for Proactive Action Is Open — But Closing

Quantum computing will arrive. The only question is whether your organisation will be cryptographically prepared when it does — or whether adversaries will be decrypting years of harvested data while you undertake an emergency migration under regulatory scrutiny.

Three Critical Truths for Boards

The Threat Is Active Now: Harvest Now, Decrypt Later is not a theoretical future concern. Nation-state actors are collecting encrypted data today. The breach window for long-horizon sensitive data is already open.
Migration Takes Longer Than Expected: Comprehensive PQC migration is a 5-10 year programme for most organisations. Starting in 2028 or 2030 will be too late for organisations handling data with long sensitivity horizons.
Early Movers Gain Competitive Advantage: PQC readiness will become a procurement requirement, a regulatory expectation, and a board governance indicator. The organisations that act now will be ahead of the mandated wave — and will be positioned to demonstrate security leadership when it matters most.

The Bottom Line

Quantum computing does not invalidate everything your organisation has built for cybersecurity. It invalidates the mathematical foundations those protections rest on. Addressing this requires investment, expertise, and board-level commitment — but the investment is modest relative to the risk, and the opportunity for competitive advantage is genuine for organisations that move first.

The cryptographic foundation of your organisation is changing.

Organisations that govern this transition actively will protect their data, satisfy regulators, and gain competitive advantage. Those that delay will face a crisis that was entirely foreseeable.

About CyberCQR

CyberCQR provides strategic cybersecurity advisory services to boards and C-suite executives. Our quantum security advisory practice helps organisations understand their cryptographic exposure, build PQC migration roadmaps, and develop the governance structures needed to manage the transition effectively.

We work with organisations in financial services, professional services, healthcare, and regulated industries — helping boards ask the right questions and management deliver the right answers.

Our Services
Schedule Consultation

References and Further Reading

NIST (2024). FIPS 203, 204, 205 — Post-Quantum Cryptography Standards
NCSC (2024). “Post-Quantum Cryptography: Preparing Your Organisation”
NCSC (2025). “Timelines for migration to post-quantum cryptography”
Gidney, C. (2025). “How to factor 2048 bit RSA integers with less than a million noisy qubits”
NSA (2022). “Cybersecurity Advisory: Quantum Computing and Post-Quantum Cryptography” — CNSA 2.0
ENISA (2024). “Post-Quantum Cryptography: Integration Study”
Shor, P. (1994). “Algorithms for Quantum Computation: Discrete Logarithms and Factoring”
CISA / NSA / NIST (2024). “Quantum-Readiness: Migration to Post-Quantum Cryptography”
IBM Research (2024). “IBM Quantum Development Roadmap”
ETSI (2024). “Quantum Safe Cryptography” standards series
BSI Germany (2024). “Recommendations for Post-Quantum Cryptography”