Quantum Computing and Encryption: Why Organisations Need to Prepare Now

22 Oct 2026

How Post-quantum Cryptography can Protect Sensitive Data before Quantum Threats Arrive

The world of cybersecurity is on the brink of a monumental shift. With the rise of quantum computing, a new class of threats looms on the horizon, threatening to disrupt existing cryptographic systems. One of the most important responses to this emerging risk is post-quantum cryptography (PQC), a field focused on developing cryptographic algorithms that can withstand attacks from quantum computers. It's crucial for businesses, governments, and individuals to understand the increasing threat posed by quantum computing and the need to prepare for this new reality.

What Is Post-quantum Cryptography?

At its core, post-quantum cryptography refers to cryptographic systems and algorithms designed to be secure against the computational power of quantum computers. To grasp the significance of PQC, it's important to first understand quantum computing and how it threatens traditional cryptographic methods.

Traditional encryption methods like Rivest-Shamir-Adleman (RSA) and elliptic curve cryptography (ECC) are built on mathematical problems, such as factoring large numbers or solving discrete logarithms, which are incredibly difficult for classical computers to solve within a reasonable time frame. However, quantum computers leverage the principles of quantum mechanics to process information in fundamentally different ways, enabling them to solve these complex problems exponentially faster than classical computers. This means that the very cryptographic algorithms securing our digital world today could be rendered obsolete in the face of quantum technology.

The Threat: Why Should We Be Concerned?

Quantum computers are still at an early stage of development, but their potential to revolutionize computing is undeniable. While large-scale, practical quantum computers don’t exist yet, scientists and researchers are steadily advancing in building them. Companies like Google, IBM, and Microsoft are already making significant progress toward creating quantum computers capable of solving problems that would take classical computers millions of years to complete. Their motivation is positive: to harness quantum computing’s power to address problems that are beyond the practical reach of today’s classical computers. Potential benefits include accelerating medical and pharmaceutical research, improving the modelling of complex systems, and helping to solve major challenges in areas such as materials science, energy and climate.

The danger for cryptography comes from quantum algorithms like ‘Shor’s Algorithm’, which can efficiently factor large numbers and compute discrete logarithms in fast amounts of time. If a sufficiently powerful quantum computer is developed, it could break the encryption systems that underpin much of today's security, including:

1. E-commerce and online banking: The encryption that secures transactions could be easily decrypted, leading to fraud, theft, and the compromise of financial systems.
2. Sensitive government data: Governments around the world rely on encryption to protect classified information. A quantum-powered attack could expose national security secrets.
3. Personal privacy: Much of our personal information, including medical records, emails, and social media activity, is protected by encryption. With the availability of quantum computing, this data could be exposed, leading to identity theft and privacy violations.
4. Critical infrastructure: Systems that manage energy, water, and transportation could be vulnerable to threat actors, leading to widespread disruption.

In essence, while quantum computing promises to unlock computational power, it also presents a profound risk to the security of our digital world, making the shift to post-quantum cryptography more critical than ever.

Harvest Now, Decrypt Later

Although quantum computers capable of breaking today’s encryption are not yet available, the risk already exists. Threat actors may use a “harvest now, decrypt later” strategy: stealing and storing encrypted data today in the expectation that future quantum technology will enable them to break current encryption standards and access the information.

Regulators are Already Paying Attention

Concerns about quantum computing's impact on cryptography aren't limited to technical authorities; financial regulators have started flagging it too. In their joint autumn 2026 risk assessment, the EU's three financial supervisory authorities (covering banking, insurance, and securities markets) named quantum computing as an emerging risk, placing it alongside AI and cyber threats as an area firms need to start preparing for.

The concern is that if quantum computers eventually become powerful enough, they could undermine the cryptographic signatures that secure digital transactions and blockchain systems, potentially exposing private keys that are currently considered safe.

Although no existing quantum computer has this capability, recent research suggests that fewer hardware resources may be required than previously estimated. This does not mean the threat is imminent, but it could shorten the expected timeframe and reinforces the need for organisations to prepare early.

The Race to Develop Post-quantum Cryptography

The urgency to develop secure cryptographic systems in the face of quantum threats has given rise to the field of post-quantum cryptography. The goal of PQC is to create cryptographic algorithms that are resistant to quantum computing attacks while remaining practical for implementation on current systems.

The goal of PQC is to introduce quantum-resistant algorithms that can initially operate alongside existing cryptographic systems such as RSA and ECC, enabling a phased and controlled migration. Over time, these new algorithms will supersede vulnerable standards where necessary, requiring substantial changes to the way communications are secured and to the hardware and software that support them.

The U.S. National Institute of Standards and Technology (NIST) has been at the forefront of the PQC initiative. NIST launched a public competition to evaluate and standardise new cryptographic algorithms capable of securing data against quantum threats. NIST reached a turning point in 2024, confirming three algorithms as official standards: FIPS 203 (ML-KEM, derived from CRYSTALS-Kyber) for establishing secure keys, FIPS 204 (ML-DSA, derived from CRYSTALS-Dilithium), and FIPS 205 (SLH-DSA, derived from SPHINCS+) for digital signatures. These took effect and organisations are now free to build them into live systems. A fourth signature standard, based on the FALCON algorithm, is still being finalised and isn't expected until late 2026 or early 2027. For the time being, the working recommendation is simply to standardise on the three algorithms already finalised: ML-KEM, ML-DSA, and SLH-DSA.

The UK's technical cyber security authority National Cyber Security Centre (NCSC) named post-quantum cryptography as a strategic priority in its 2024 annual review, following NIST's finalisation of PQC algorithm standards that August, pointing to the exposure of government systems and critical national infrastructure and the need to begin planning a switch to the new algorithms. That early warning has since hardened into concrete guidance: in 2025, the NCSC issued a formal timetable for the UK's transition, built around three checkpoints:

• 2028 – organisations should have settled on their migration objectives, mapped which systems and services rely on cryptography that needs replacing, and drawn up an opening plan for the work ahead.
• 2031 – the most urgent, highest-risk changes should be done, with the original plan sharpened into a more detailed path to full migration.
• 2035 – the switch to PQC should be complete across every system, service and product, though the NCSC accepts that a small number of niche technologies may struggle to hit this date.

In its 2025 annual review, NCSC reported that this timetable was already shaping plans across government and regulated industries. In the same year, it began accrediting independent PQC consultancies, approving an initial eight firms, and helping to set international practice by authoring RFC 9794, now a widely used reference for standard PQC terminology.

The EU has taken a similar path on its own timeline. Following a European Commission recommendation in 2024, Member States agreed a coordinated roadmap in 2025, with national transition plans due by the end of 2026, high-risk systems migrated by 2030, and the wider transition completed by 2035 wherever practicable.

A Global Effort

The push toward quantum-safe cryptography isn't confined to the U.S., UK and EU. China is charting its own course, running a national algorithm competition rather than adopting NIST's standards outright. Japan and South Korea have both set their own migration targets and are running national reviews of quantum-safe algorithms. Singapore has published its own readiness guidance for critical infrastructure, and Malaysia became the first country in Southeast Asia to publish a national PQC roadmap. Despite some differences in regional guidance and timeframes, the direction of travel is the same everywhere – start planning now.

Preparing for Quantum: What Can We Do Now?

While the threat of quantum computing is still evolving, there are steps that businesses, governments, and individuals can take now to prepare for the impending changes:

1. Stay informed around PQC: As NIST and other organisations and regions finalise their post-quantum cryptography standards, it’s important for businesses and cybersecurity professionals to stay informed and start planning for adoption.
2. Begin transitioning to quantum-resistant algorithms: Although widespread adoption of PQC algorithms may take time, businesses can start experimenting with quantum-resistant cryptography and incorporate it into their systems. This can be done through hybrid systems that combine classical and quantum-resistant encryption.
3. Focus on long-term data protection: For data that needs to remain secure for decades, such as government or financial records, businesses should consider using quantum-resistant encryption methods now to safeguard against future threats.

Final Thoughts

The rise of quantum computing poses a genuine long-term threat to the encryption that currently protects digital communication and data. While a quantum computer capable of breaking today's cryptography does not yet exist, and is likely still some time off, the risk is not purely future facing: data intercepted and stored now could be decrypted retrospectively once that capability arrives with the "harvest now, decrypt later" threat. That's why bodies including NIST, NCSC, the EU, and their counterparts across Asia and beyond are all pushing organisations to start planning well ahead of an actual quantum breakthrough. Post-quantum cryptography is the primary response to this risk, and adopting quantum-resistant algorithms early in line with the timelines set out will be key to keeping sensitive data secure as the technology matures.

Intertek helps organisations prepare for the next generation of cybersecurity challenges through consultancy, assurance and compliance services focused on post-quantum cryptography and software supply chain security. Our experts support businesses and government bodies with PQC readiness assessments, cryptographic discovery and migration planning, helping them understand and mitigate future quantum-related risks. We also provide guidance on software bills of materials (SBOMs), cryptography bills of materials (CBOMs), secure development practices and regulatory requirements, enabling organisations to improve visibility across their technology estate and demonstrate compliance with emerging cybersecurity frameworks. The result is a clear roadmap for cyber resilience, helping organisations innovate with confidence while reducing security and compliance risk.

Sources:

https://www.esma.europa.eu/sites/default/files/2026-09/JC_2026_29_JC_update_on_risks_and_vulnerabilities_autumn_2026.pdf

https://www.ncsc.gov.uk/guidance/pqc-migration-timelines

https://digital-strategy.ec.europa.eu/en/library/coordinated-implementation-roadmap-transition-post-quantum-cryptography

https://www.nist.gov/pqc