The Quantum Shift Is Coming
For decades, we have relied on public-key algorithms such as RSA and elliptic-curve cryptography (ECC) to secure our digital infrastructure, from online banking transactions to government communications. The arrival of quantum computing is set to change that.
Quantum computers are advancing quickly, backed by heavy public and private investment. For certain mathematical problems, including the integer factoring and discrete logarithm problems that underpin RSA and ECC, a large fault-tolerant quantum computer running Shor’s algorithm would be dramatically faster than any classical computer. That is revolutionary for science and medicine, but it is a serious problem for digital security.
The cybersecurity world calls the moment this becomes possible “Q-Day”: the day a cryptographically relevant quantum computer (CRQC) can break the public-key algorithms we use today. No such machine exists yet, but published resource estimates keep falling. In May 2025, Google researcher Craig Gidney estimated that RSA-2048 could be factored in under a week with fewer than one million noisy qubits. We cover the threat timeline in detail in Part 2.
Symmetric algorithms such as AES are far less affected: AES-256 is still considered secure against known quantum attacks. The urgent problem is public-key cryptography, used for key exchange and digital signatures.
What Is Post-Quantum Cryptography (PQC)?
Post-Quantum Cryptography (PQC) refers to public-key algorithms designed to resist attack by both classical and quantum computers. Unlike quantum key distribution, PQC needs no special hardware: it runs as software and firmware on today’s computers, networks and devices, although its larger keys and signatures can affect protocols and constrained systems.
The National Institute of Standards and Technology (NIST) ran a multi-year public competition to select post-quantum algorithms. On 13 August 2024 it published the first three final Federal Information Processing Standards (FIPS 203, 204 and 205), and further standards are in development.
NIST’s PQC Standards (status as of October 2026):
ML-KEM (FIPS 203)
Module-Lattice-Based Key-Encapsulation Mechanism Standard
Final (August 2024). A lattice-based key-encapsulation mechanism (KEM) that replaces RSA key transport and (EC)Diffie-Hellman key agreement for establishing shared secret keys. It is already deployed in TLS 1.3 and VPNs, typically in hybrid mode alongside a classical algorithm.
ML-DSA (FIPS 204)
Module-Lattice-Based Digital Signature Standard
Final (August 2024). NIST’s primary general-purpose post-quantum signature algorithm, intended to replace RSA, ECDSA and EdDSA signatures for certificates, authentication and code signing.
SLH-DSA (FIPS 205)
Stateless Hash-Based Digital Signature Standard
Final (August 2024). A stateless hash-based signature scheme derived from SPHINCS+. Its security relies only on hash functions, making it a very conservative choice, at the cost of larger signatures and slower signing.
FN-DSA (FIPS 206, in development)
FFT (fast-Fourier transform) over NTRU-Lattice-Based Digital Signature Algorithm
A compact lattice-based signature algorithm derived from Falcon, offering smaller signatures than ML-DSA. As of October 2026, NIST still describes FIPS 206 as under development; it is not yet an approved standard.
Two further pieces complete the picture. In March 2025, NIST selected HQC, a code-based KEM, as a backup to ML-KEM built on different mathematics; a FIPS specifying HQC-KEM is under development. NIST planned a draft for public comment about a year after selection and a final standard in 2027; as of late October 2026 the draft had not yet been published. In September 2025, NIST published SP 800-227, Recommendations for Key-Encapsulation Mechanisms, which explains how to use KEMs such as ML-KEM securely.
The Business Impact: A Cryptographic Cliff Ahead
Organisations face what is often called a “cryptographic cliff”. Quantum-vulnerable public-key cryptography will not simply weaken gradually: once a CRQC exists, RSA and ECC offer no meaningful protection against whoever controls it.
Think about:
Online banking sessions protected by TLS using RSA or ECC key exchange and certificates.
Software and firmware updates signed with classical digital signatures.
Encrypted data and communications that must remain confidential for many years.
The last point is already a live risk: adversaries can record encrypted traffic today and decrypt it later, an attack known as “harvest now, decrypt later”. The question is not if, but when, and whether your organisation is ready to migrate in time.
Quantum Readiness: More Than a Technical Project
Transitioning to PQC is not just about swapping algorithms. It is a strategic, organisation-wide initiative that touches every layer, from governance and compliance to applications and embedded systems.
A robust Post-Quantum Cyber Readiness strategy includes:
Crypto Discovery: identify where cryptography is used across systems, applications, networks and embedded devices.
Crypto Inventory & Classification: build a Cryptographic Bill of Materials (CBOM) recording algorithms, key lengths, protocols and certificates in use. Platforms such as Quantum Sentinel, an Enterprise Cryptographic Exposure Management platform, support PQC discovery, CBOM creation, exposure assessment and migration planning using read-only metadata collection.
Risk Assessment: prioritise systems and data with long-term confidentiality requirements.
Migration Planning: define transition paths to NIST-approved PQC algorithms (FIPS 203, 204 and 205), often using hybrid modes first, and plan phased integration.
Governance & Policy Updates: embed cryptographic agility into enterprise policies, procurement and vendor contracts, so you can adopt future standards such as FN-DSA and HQC without another overhaul.
The timelines are now set. NIST IR 8547, Transition to Post-Quantum Cryptography Standards (final, 27 October 2026), deprecates quantum-vulnerable algorithms such as RSA, ECDSA, EdDSA and (EC)DH after 2030 and disallows them under NIST standards after 2035. The UK NCSC (March 2025) expects organisations to complete discovery and an initial plan by 2028, priority migrations by 2031 and full migration by 2035. In the US, OMB M-26-15 (June 2026) requires federal high value assets and high impact systems to adopt PQC for key establishment by 31 December 2030 and for signatures by 31 December 2031.
Final Thought: Prepare, Don’t Panic
Quantum computing does not spell the end of cybersecurity, but it does require proactive adaptation.
Organisations that start preparing now will not only safeguard their data, but also gain an advantage by meeting regulatory expectations and keeping customer trust in the post-quantum era.
The future of cryptography is already being written.
The only question left is: will you be ready?
Sources: NIST, FIPS 203, 204 and 205 (13 August 2024); NIST IR 8545, HQC selection (11 March 2025); NIST SP 800-227 (18 September 2025); NIST IR 8547, final (27 October 2026); UK NCSC, Timelines for migration to post-quantum cryptography (20 March 2025); C. Gidney, How to factor 2048 bit RSA integers with less than a million noisy qubits, arXiv:2505.15917 (May 2025).
Our Post-Quantum Readiness Series
This article is Part 1 of our Post-Quantum Cyber Readiness Series, which explains complex quantum-security concepts in practical terms.
The series covers:
For a current view of deadlines and regulator expectations, see also PQC Migration Readiness in 2026.
Each article is written to help CEOs, CISOs, IT leaders and architects navigate the quantum transition with confidence.
