Post-quantum cryptography has become a top priority for cybersecurity leaders, yet recent research indicates that some organizations are not treating the threat with the seriousness it demands.

Quantum computers will eventually be capable of solving the mathematical problems that underpin asymmetric public key cryptography (PKC), an event referred to as 'Q-day'.

As attackers begin employing a 'harvest-now, decrypt-later' strategy, experts are advising business leaders to start preparing now to avoid future vulnerabilities.

However, according to a new report by Capgemini, although 70% of organizations are evaluating or implementing quantum-safe strategies, only 15% of these can be classified as 'quantum-safe champions', possessing robust governance and technical capabilities.

Meanwhile, 30% of surveyed organizations continue to underestimate the immediacy of quantum threats, leaving themselves exposed to potential data breaches and regulatory consequences.

Over eight out of ten (82%) respondents stated that a significant breakthrough in quantum computing would prompt their organization to prioritize post-quantum cryptography (PQC) more urgently.

"People tend not to believe it until it actually happens. The first public breach exploiting quantum decryption will create urgency," said Julio Padilha, CISO of Volkswagen & Audi, South America.

"Until that moment, justifying investment in something invisible is difficult."

Roughly half of early adopters are experimenting with PQC pilots, often collaborating with cloud providers and niche vendors, but most still lack a comprehensive enterprise-wide migration plan.

"The biggest challenge is aligning timelines and getting the entire ecosystem on board to ensure that available solutions are secure against current threats and resilient to future cryptographic attacks," explained Michele Mosca, CEO of evolutionQ and co-founder of the Institute for Quantum Computing at the University of Waterloo.

According to Capgemini, leading organizations—those deemed quantum-safe champions—are actively managing cryptographic inventories, engaging their supply chains, and preparing hardware to fast-track their transition.

They conduct quantum risk assessments, maintain real-time cryptographic asset records, promote company-wide awareness, and implement governance structures that keep quantum security a focus for executive leadership.

Additionally, they design systems with crypto-agility in mind to remain adaptable as standards evolve.

"We started our journey toward quantum safety in 2023 with a cryptographic posture and maturity evaluation," said Luciano Carolino, IT security specialist at Bradesco bank.

"It’s a long-term initiative, beginning with building a complete inventory of cryptographic assets and using a risk-based prioritization method across infrastructure and applications."

Four out of five early adopters told researchers that collaboration across industries—including partnerships with government agencies and technology coalitions—is essential to mitigating quantum-related risks.

Accelerating post-quantum cryptography adoption

Governments around the world are taking this threat seriously, with the UK’s National Cyber Security Centre (NCSC) publishing a timeline for successful PQC implementation earlier this year.

By 2028, organizations should have clearly defined migration objectives, completed a full discovery process, and developed an initial migration strategy.

By 2031, the highest-priority PQC migrations should be completed, and organizations should refine their plans to include a detailed roadmap for full migration. Full adoption of PQC is expected by 2035.

"If your organization hasn’t started planning for quantum readiness, you're already lagging behind," warned Marjorie Bordes, group CISO at Capgemini.

"Migrating to PQC involves multiple departments, requires time, and presents complex challenges. Delaying action increases exposure, hinders compliance, and weakens your ability to stay competitive and protect sensitive information in the coming years."

Stay updated with all our latest news, analysis, and reviews by following php.cn on Google News.*

The above is the detailed content of Post-quantum cryptography is now top of mind for cybersecurity leaders. For more information, please follow other related articles on the PHP Chinese website!