At the recent AI Networking Summit in New York many panels addressed the threats from quantum for cryptography. Here are some takeaways and my own thoughts:
The US government has been preparing for a cryptographically relevant event since 2010, but most companies are not acting yet to prepare for Q-Day, the day when quantum technology can break prevalent encryption mechanisms. Because quantum computers powerful enough to break encryption are not yet available, some people do not perceive the immediacy of the threat. However, it is already late because being ready takes years, and it is very likely that Harvest Now Decrypt Later (HNDL) attacks are already happening.
In the US, executive order 14412, titled "Securing the Nation Against Advanced Cryptographic Attacks," was signed on June 22, 2026. It stipulates that federal agencies must transition high-value assets to PQC by December 31, 3030, and must transition digital signatures by December 31, 2031. Companies working with the federal government have to comply with this order.
Recently, NIST started a timeline to retire quantum-vulnerable encryption.
France also issued new timelines. In 2027, ANSSI will stop issuing new security certifications for products that lack post-quantum encryption and by 2030, organizations working with the French government must be quantum safe.
In 2027, corporate governance faces a critical convergence of cybersecurity, crypto/digital assets, and board-level fiduciary responsibility. This means that under the Duty of Care and Duty of Loyalty standards, boards will be required to have active oversight of these risks.
So it is imperative that companies have a plan to be ready for quantum. But what should they do? here are some (non-comprehensive) suggestions:
· Appoint an expert who owns quantum in the company. Ensure that there is an adequate budget, and that other stakeholders in the organization are working with the quantum "owner".
· Start with a discovery. Where is cryptography in the environment. Create an inventory, or what the industry calls CBOM (Cryptographic Bill of Materials). Focus on data with a long shelf life. However, while this is important, it is even more important to act quickly on high-risk areas, even if the CBOM is not complete. So the asset discovery, while important, is not an end in itself. It can proceed in parallel while the firm starts to focus on its most critical assets.
· Develop a migration plan, socialize across the firm, ensure buy in and develop a process to manage and monitor progress
· Make Crypto Agility a guiding principle. The technology is moving fast, and standards are solutions are evolving.
· Upskill talent. While ownership is largely in the CISO organization, it touches many aspects of the firm. While AI is top of mind, some people may not know what quantum is. Everyone needs a basic level of understanding (quantum is not only a threat, but also a significant opportunity).
· Ensure that key staff focused on quantum security is knowledgeable about the latest technologies, such as key distribution or PQC. The IETF is still figuring out the best approach for digital signatures.
· Survey suppliers, partners and others, about their quantum readiness and their roadmap.
· Start with quick wins, easy to implement, plug and play situations
· As the company replaces solutions / equipment, make quantum readiness a key requirement
· Focus on highly critical situations. For example, if 30% of the workforce works remotely, ensure that those links are protected
· Think holistically. For example, in a data center, network packet size must be adjusted to optimally carry the larger key size for PQC. For old mainframes or other old equipment, customized solutions will be needed.
These are some of the things companies with critical data should be doing.
The board retains a supervisory role to ensure that the firm has a plan, is executing against the plan and that the plan is kept up to date as the technology, the regulation and the market are changing.
