Separating signal from hype
Quantum computing promises dramatic speed-ups for specific classes of problem: simulating molecules, certain optimisation tasks, and — most relevant to every business — breaking widely used public-key cryptography. It will not make ordinary web applications faster, and general-purpose quantum servers are not on the near-term horizon.
The practical question for most organisations is therefore not “how do we use quantum computers?” but “how do we stay secure when others have them?”
The “harvest now, decrypt later” risk
Encrypted traffic captured today can be stored and decrypted later, once sufficiently powerful quantum machines exist. Data with a long shelf life — health records, financial data, intellectual property, government communications — is already exposed to this risk.
Post-quantum cryptography is here
NIST has published its first post-quantum cryptography standards (FIPS 203, 204 and 205), covering key establishment and digital signatures designed to resist quantum attacks. Browsers, operating systems and cloud providers are already rolling out hybrid schemes that combine classical and post-quantum algorithms.
A pragmatic readiness plan
Organisations can prepare without waiting for the hardware:
- Inventory where and how cryptography is used across your systems and vendors.
- Prioritise long-lived sensitive data and externally exposed services.
- Build crypto-agility: centralise cryptographic choices so algorithms can be swapped without rewrites.
- Track vendor roadmaps for post-quantum support in TLS, VPNs, HSMs and identity providers.
