Post-quantum cryptography: why to start thinking about it now
Usable quantum computers don’t exist yet, but the agreements on how we prepare for them are already here. Not a scare story, but a level-headed look at what’s coming and what you can calmly do about it in good time.
What is this actually about?
Almost everything you do online is protected by cryptography: your online banking, your email, the VPN to the office, the certificates on your website. That protection relies on calculations that are practically impossible for an ordinary computer to reverse.
A sufficiently powerful quantum computer can solve some of those calculations efficiently. That puts today’s public-key cryptography (think RSA and ECC, the technology behind the padlock in your browser) under pressure over time. Such a machine doesn’t exist at a usable scale yet, but serious parties, from the European Commission to national cyber agencies, assume we need to prepare for it now.
“Harvest now, decrypt later”
The reason this matters today comes down to a simple but uncomfortable idea: data intercepted now can be decrypted later. An attacker doesn’t need to break the encryption today; they can simply store encrypted data and wait until the technology catches up.
For many smaller firms that’s not an acute problem, if your data is worthless in a few years, you won’t lose sleep over it. But if you handle information that must stay confidential for a long time (medical data, contracts, intellectual property, personal data), it’s worth having on your radar.
You don’t have to replace everything tomorrow. You do need to know what you have and how fast you can switch.
The technology is ready
The good news: new, quantum-resistant algorithms already exist. In August 2024 the US standards body NIST published the first official post-quantum cryptography standards: FIPS 203, 204 and 205. These are the basis on which vendors will gradually rebuild their products.
So you don’t need to develop anything yourself. The switch happens largely through updates to the software, operating systems and services you already use. Your job is mainly to make sure you are ready to follow those updates.
What Europe is agreeing on
In 2024 the European Commission issued a recommendation for member states to move towards post-quantum cryptography together. In 2025 a joint roadmap followed with target dates: around end of 2026 for preparation and national plans, around 2030 for the most critical systems to be migrated, and towards 2035 for the rest where feasible.
Worth knowing: these are target dates for governments and critical infrastructure, not a blanket legal deadline for every business. For most smaller firms it’s mainly a signal: the move has started, vendors are following, and it’s wise not to fall behind.
What can you do now?
No major overhaul, just a few level-headed steps that are good for your digital hygiene anyway:
- Know what you have. A simple overview of where your sensitive data sits and which systems and vendors protect it (a “crypto inventory”).
- Keep software up to date. Most of the transition comes via updates; if you stay current as a matter of course, you’ll largely get post-quantum along the way.
- Ask your vendors. Do your key software and cloud services have a plan for post-quantum cryptography? The answer tells you a lot about their maturity.
- Work on crypto-agility. Make sure you can switch without replacing everything , that makes this and every future security change easier.
This fits seamlessly with the work we do under consultancy & architecture: creating an overview, weighing the risks and making a plan that suits the size of your organisation.
Curious whether this applies to you?
In one conversation we look at whether post-quantum cryptography is relevant for your organisation and, if so, which first step makes sense. Level-headed, no scaremongering.