A Post-Quantum Cryptography Countdown Begins: Are Organizations Prepared?
The post-quantum cryptography (PQC) transition is no longer a distant threat, but a looming reality that’s forcing organizations to scramble for a plan. While many security leaders acknowledge PQC as a priority, the harsh truth is that most companies are still stuck in the discovery phase. In fact, recent studies suggest that only 44% of organizations have developed transition plans or created inventories, leaving them woefully unprepared for the impending quantum computing era.
The issue at hand is not just about replacing old cryptography with new; it’s a sweeping effort to enumerate and update every encryption use case across an organization. Cryptography permeates modern technology, from web servers and certificates to VPNs, code signing, and vendor products. Without a comprehensive understanding of their cryptographic estate, organizations risk being left in the dust as quantum computers continue to advance at an unprecedented pace.
The ticking clock is known as Q Day, which marks the point when a cryptographically relevant quantum computer can break public-key cryptography used for key exchange and digital signatures. While estimates for Q Day’s arrival vary between 2030 and 2040, researchers are now predicting it could happen as early as 2029. This accelerated timeline has global governments taking notice, with the US National Institute of Standards and Technology (NIST) finalizing its PQC transition roadmap in October and the UK’s National Cyber Security Centre urging large organizations to complete discovery and assessment by 2028.
The math behind public-key cryptography is straightforward: it relies on mathematical problems that are easy to solve forward but impractical to reverse. However, quantum computers can leverage subatomic particles to tackle these problems with ease. This poses a significant threat to RSA encryption, elliptic curve cryptography, and Diffie-Hellman key exchange, all of which are widely used today.
For organizations, the takeaway is clear: it’s time to stop talking about PQC and start acting. The transition will be a generational effort, requiring a detailed inventory of cryptographic assets and a plan for migrating to post-quantum algorithms. While there’s no set deadline for Q Day, the writing is on the wall – organizations must get their house in order or risk being left vulnerable to quantum attacks.
To avoid this fate, CISOs should prioritize developing a comprehensive understanding of their cryptographic estate and creating a transition plan that addresses every encryption use case. This involves not only identifying existing cryptography but also assessing its vulnerabilities and developing strategies for updating or replacing it with post-quantum alternatives. It’s a daunting task, but one that must be tackled head-on if organizations hope to stay ahead of the quantum computing curve.
Source: Dark Reading — 2026-11-12