Key Takeaways
- • Quantum computing capable of breaking current encryption standards could arrive within three to five years, with IBM investing over US$10 billion to deliver the first large-scale fault-tolerant quantum computer by 2029, according to Blair Canavan, Director Alliances at Thales.
- • Cyber criminals are actively executing "harvest now, decrypt later" attacks by stealing encrypted data today in anticipation of future quantum computers that will unlock it, creating an immediate threat to organizations regardless of quantum hardware deployment timelines.
- • Digital signatures and certificates based on RSA and ECC encryption are at risk of forgery through "trust now, forge later" attacks, where quantum computers will enable hackers to fake software updates, identity certificates, and system commands—threatening system integrity and trust more than data theft alone.
- • Organizations must achieve "crypto-agility"—the ability to rapidly change or replace cryptographic algorithms, keys, and protocols without operational disruption—to prepare for post-quantum threats and mitigate migration costs and timeline compression when standards shift.
- • Investing in cryptographic agility infrastructure now will accelerate future transitions to post-quantum cryptography (PQC) standards, making deployments faster, more efficient, and less costly when quantum-resistant algorithms become mandatory across enterprise systems.
Summary
The quantum computing threat to global encryption infrastructure has moved from theoretical risk to concrete timeline, with experts warning that cryptographically relevant quantum systems could emerge within three to five years. Blair Canavan, Director Alliances, PKI and PQC Portfolio at Thales, noted during a recent webinar hosted by the Institute of Information Technology Professionals South Africa (IITPSA) cyber security group that major technology companies are accelerating quantum hardware development. IBM has committed over US$10 billion in coming years specifically to deliver the first large-scale fault-tolerant quantum computer by 2029—a milestone that would render current public key encryption protocols obsolete.
The immediate threat, however, extends beyond future quantum deployment. EG Nadhan, Chief Quantum Ambassador at QuantaCyber, highlighted that adversaries are already executing "harvest now, decrypt later" campaigns by stealing encrypted data today, betting they will possess quantum decryption capabilities within years. This attack vector creates a present-day vulnerability for any organization handling sensitive long-lived data—financial records, intellectual property, trade secrets, and classified communications are all targets. Simultaneously, "trust now, forge later" attacks threaten the integrity of digital signatures and certificates that organizations and users trust implicitly today. Once quantum computers mature, hackers will be able to forge software updates, identity certificates, and system commands, compromising system safety and institutional trust at a foundational level.
Organizations cannot wait for quantum hardware deployment before acting. The consensus among post-quantum cryptography experts is that enterprises must begin building "crypto-agility"—the capacity to rapidly swap cryptographic algorithms, keys, and protocols without operational downtime or architectural redesign. Crypto-agility provides visibility and control over cryptographic assets across systems, enabling organizations to migrate to post-quantum cryptography (PQC) standards when they become mandatory without catastrophic cost and timeline compression. According to the expert panel, investing in cryptographic agility infrastructure now will significantly reduce the complexity, expense, and risk associated with eventual PQC migration. Delaying action until quantum threats materialize will leave organizations facing rushed, expensive, and potentially incomplete transitions across legacy and modern systems simultaneously.
The immediate threat, however, extends beyond future quantum deployment. EG Nadhan, Chief Quantum Ambassador at QuantaCyber, highlighted that adversaries are already executing "harvest now, decrypt later" campaigns by stealing encrypted data today, betting they will possess quantum decryption capabilities within years. This attack vector creates a present-day vulnerability for any organization handling sensitive long-lived data—financial records, intellectual property, trade secrets, and classified communications are all targets. Simultaneously, "trust now, forge later" attacks threaten the integrity of digital signatures and certificates that organizations and users trust implicitly today. Once quantum computers mature, hackers will be able to forge software updates, identity certificates, and system commands, compromising system safety and institutional trust at a foundational level.
Organizations cannot wait for quantum hardware deployment before acting. The consensus among post-quantum cryptography experts is that enterprises must begin building "crypto-agility"—the capacity to rapidly swap cryptographic algorithms, keys, and protocols without operational downtime or architectural redesign. Crypto-agility provides visibility and control over cryptographic assets across systems, enabling organizations to migrate to post-quantum cryptography (PQC) standards when they become mandatory without catastrophic cost and timeline compression. According to the expert panel, investing in cryptographic agility infrastructure now will significantly reduce the complexity, expense, and risk associated with eventual PQC migration. Delaying action until quantum threats materialize will leave organizations facing rushed, expensive, and potentially incomplete transitions across legacy and modern systems simultaneously.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.