Why Post-Quantum Cryptography Can't Wait For Tomorrow

Forbes

a day ago

Ryan Frankel is President & CTO of HostingAdvice.
Much like nuclear fusion, it seems quantum computing is always a decade or two away from hitting the mainstream. Giant machines crunching calculations in parallel would give them the ability to crack encryption that would take today's fastest supercomputer millions of years.
While we're certainly still a few years away from this, bad actors are already ingeniously preparing for the moment. They're stealing and storing encrypted data, betting that in five or 10 years, they'll have access to a quantum computer capable of unlocking it. This tactic, known as harvest-now-decrypt-later, turns someday into a ticking clock for organizations managing sensitive data.
For those of us working in data centers, cloud infrastructure, web hosting and related services, this risk is fast becoming a security vector that we can no longer ignore.
If your business handles sensitive information, such as financial transactions, customer records and contracts, some of that data will still matter years from now. And when quantum computers get up to speed, everything encrypted with traditional methods can be fair game.
Luckily, I'm not the only one who has thought about this. Companies are starting to release post-quantum cryptography that will help alleviate this concern, even if it doesn't totally resolve it.
Most of our encryption stays safe behind complex math problems that are hard for classical computers to solve. With enough time, current computers can, in theory, break that encryption—but it would take centuries. If current computers are opening one door at a time, quantum computers are opening all of the doors at once. It is speed that enables them to easily foil today's encryption techniques.
While, as Richard Feynman famously said, 'nobody understands quantum mechanics,' folks understand it enough to have built current computers of more than 1,000 qubits.
The day someone gets a quantum machine running at scale, the encryption we trust could become obsolete almost overnight. It won't just compromise future data. It will unlock whatever is sitting in storage, collected years before.
Post-quantum cryptography (PQC for short) is a set of tools and techniques designed to stay secure even against quantum computers. These systems rely on mathematical puzzles that quantum machines can't easily solve.
If you follow the National Institute of Standards and Technology's (NIST) ongoing project to standardize PQC algorithms, you've probably heard the terms 'Kyber' and 'Dilithium.' Kyber is quantum-safe encryption and Dilithium is a digital signature that quantum computers cannot easily forge.
These tools are already moving from research to practice. Cloud providers are testing them and browsers are experimenting with them. Some companies are layering PQC into TLS (the technology that keeps websites secure), so even if quantum decryption becomes possible, the locks will still hold.
Even if you're not ready to jump in with both feet, you can start taking practical steps now to get ready:
• Take inventory. Make a list of where encryption is used in your business. Focus on what needs to stay secure for years to come. Backups, archives and long-term contracts are good places to start.
• Talk to your vendors. Ask your cloud and hosting providers how they're planning for the quantum transition. If they don't have an answer yet, press for a plan.
• Experiment early. Some tools already support 'hybrid' encryption, pairing current algorithms with quantum-resistant ones. Set up test environments and see how they perform.
• Educate your teams. Bring your developers and security staff up to speed. Even a basic understanding of what PQC is and why it matters will help them make informed decisions down the road.
• Keep watch. Standards are still evolving. NIST will finalize recommendations soon, and leading organizations like Cloudflare and Google regularly share updates and guides. Appoint someone on your team to follow this closely.
The biggest misconception about post-quantum cryptography is that it's a problem for the next decade. In reality, the groundwork you lay today is what will protect you tomorrow. Switching to new encryption systems is becoming easier and will be at the flip of the switch in the coming months.
Every week you wait is another week attackers can collect encrypted data that may still be valuable years down the line. Quantum computing may still be in its early stages, but its impact on security is already here. Harvest-now-decrypt-later isn't a theory—it's happening.
You don't have to overhaul everything today. But you do have to begin. Inventory your systems. Talk to your providers. Test the tools. Stay informed.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?