Within the next decade, advances in quantum technology will result in sufficiently powerful machines that could undermine todayâs encryption standards.
Experts have warned that advances in quantum computing pose real risks to cybersecurity, digital trust, and long-term business resilience. This means quantum security is no longer a distant threat but a pressing governance issue. For boards overseeing cybersecurity risk, supply chain exposure, and long-lived sensitive information, the question is no longer whether quantum attacks are possible, but whether the organization is prepared to remediate current encryption vulnerabilities before quantum computing power makes them exploitable at scale.
The message is clear: quantum readiness requires planning now.
Sushmita Ruj, Faculty of Engineering Lead at the UNSW Institute for Cybersecurity, IFCYBER and Associate Professor at the School of Computer Science and Engineering (CSE), UNSW, Sydney, says that not all quantum machines pose a threat to current encryption methods.
âCryptographically relevant quantum computers have the power to break currently used public key algorithms like RSA and ECDSA, which are the backbone of many communication protocols and secure applications. Much of the encryption today relies on algorithms like RSA and  These will no longer remain secure.â
Post-quantum cryptography is essentially a new way of âlocking upâ information so that even quantum computers â very powerful future computers â wonât be able to gain access to it. The encryption and authentication algorithms used to keep data safe today â RSA and other common public key algorithms, for example â work well against conventional computers but could be easily cracked by more advanced quantum computers.
âThis has a significant impact on personal data, such as health records and credentials, as well as sensitive government and corporate information,â says Ruj.
Public-key systems such as RSA and ECC underpin secure web browsing, digital signatures, authentication protocols, and secure data exchange across supply chains. If broken, the impact would extend across providers, customers, and global digital ecosystems.
Ruj says that although the exact timeline for deploying this new technology remains uncertain, the direction is clear. âWith the advancement of quantum computing, the risk is pretty high. Though we might not have cryptographically relevant quantum computers for another five to 10 years, the transition process is so slow that if we donât start now, then it will be hard to change to quantum-safe systems overnight,â she says.
âTo give some numbers, currently, we have quantum computers with a little more than 1,000 qubits; a cryptographically relevant quantum computer might potentially need around a million qubits to break RSA-2048 [a very large digital key that is extremely difficult to crack].â
The implication for risk management is significant. Even if cryptographically relevant quantum computers are years away, sensitive information encrypted under current systems today could be exposed in the future.
âOne of the most concerning quantum threats is known as harvest now, decrypt later.â
ĂykĂŒ IĆık, Professor of Digital Strategy and Cybersecurity at IMD, explains that a quantum computer is not just a faster computer â itâs a completely different kind of machine.
âFor a narrow â at least, currently â set of problems, it can use different physics to explore solution spaces in ways classical computers canât,â she says. âThe main security issue resulting from this is that, if a sufficiently capable quantum computer becomes publicly accessible or commercially available, it can undermine the assumptions behind widely used public-key algorithms that power our web security infrastructure, such as data encryption, user authentication, and digital signatures.â
IĆık explains that modern digital trust is grounded in the mathematical hardness assumptions behind cryptographic algorithms. In practice, security depends on encryption schemes built on problems that classical computers find computationally infeasible to solve at scale.
âQuantum computers will be able to solve these mathematical problems effortlessly. Even though the transition to quantum computers may be slow, the breakthrough through wide availability will be sudden. That is why being ready is so important.â
One of the most concerning quantum threats is known as harvest now, decrypt later. âIt means attackers can steal encrypted data today, store it, and decrypt it later when quantum capability makes that feasible,â explains IĆık.
âThat turns quantum into a delayed-breach problem: the theft happens now but the damage can arrive years later. Boards should care because it changes the risk profile of long-lived sensitive data, such as IP, strategy, and customer records, where confidentiality must hold for a decade or more. Unfortunately, we know that the theft of encrypted data is already happening â and has been for several years.â
For sectors handling long-lived data â including healthcare records, financial services data, and government systems â quantum risk then becomes a strategic governance issue, not just a technical vulnerability.
Where organizations get stuck is often around costs and uncertainty.
Ruj says business leaders often assume post-quantum cryptography is a simple swap for existing classical encryption and signature algorithms, but that this is not the case.
âThere have been efforts around the world, with some algorithms being standardized by the National Institute of Standards and Technology. It is often easy to think, why donât we replace a classical algorithm with a PQ algorithm? Itâs not easy to plug and play. Partly because of the performance bottlenecks associated with post-quantum cryptography algorithms, which impact the quality of service,â she explains.
âSome, like SLH-DSA, have large signature sizes, whereas ML-DSA has large public key sizes. Larger keys and signatures increase bandwidth, storage, and processing demands. Added to this, there are legacy systems, which are hard to upgrade.â
Where organizations get stuck is often around costs and uncertainty. âPost-quantum cryptography transition is expensive because it requires upgrading systems and processes and investing in capacity building and training,â says Ruj, who adds that many organizations are ânot convincedâ itâs worth spending money for such upgrades.
At the same time, while new infrastructure support, products, and services are available, choosing a well-tested, stable, and reliable one can be hard for organizations. âMany solutions are not standardized and therefore carry some associated risks,â she says.
Unlike AI, whose productivity gains and profit potential are visible even to everyday users, post-quantum cryptography offers no immediate or obvious commercial upside, says Ruj. âIn the case of post-quantum cryptography, individual customers cannot see the immediate value. Post-quantum cryptography might not generate immediate revenue for organizations, but what it can do is to save millions of dollars that can otherwise be lost in quantum attacks.â
IĆık warns that waiting only compounds exposure. âWaiting only shrinks your options. You accumulate cryptographic debt as new systems hard-code todayâs algorithms, while the eventual migration becomes bigger, costlier, and more rushed. And when the industry flips, everyone will scramble at once â vendors, auditors, certificate authorities, consultancies â exactly when you donât want to be improvising.â
She urges boards to move beyond abstract monitoring and towards concrete risk assessment by asking:
âIf management canât answer these precisely, the organization is not ready, only optimistic,â she says.
Ruj adds that technical literacy at the governance level is essential. âMy first suggestion to the board is to have well-qualified cybersecurity technical experts. This is a highly technical problem, and failing to understand its magnitude and the proper approaches to address it can lead to improper company policies and decisions.
âThey should start preparing now. Their customer data is at risk, which could cost them more than the cost of migration. Delaying the process of migration means that they might later have to make decisions in a hurry and are prone to making mistakes.â
In Australia, the Australian Signals Directorate has issued migration guidance, and comparable frameworks exist internationally. Organizations are being instructed to follow suggested timelines, as transitioning to post-quantum cryptography is a gradual process that cannot be completed quickly.
âIt is a very slow process and needs time and effort. So, the earlier they start, the better,â says Ruj. âThe organization should begin understanding risks and prioritizing the post-quantum cryptography migration. This would include building an inventory of crypto assets, finding dependencies between them, evaluating the risk, and taking a phased approach to post-quantum cryptography migration.â
This is also where training and awareness are crucial, and where universities, government, and industry can play an important role. âThere is a need for extensive discussions between technology and policy experts to ensure that the technology implementation is backed by strong policies and regulations,â she adds.
In trust-based ecosystems, laggards become the weak link commercially through partner friction, operationally through interoperability issues, and reputationally through questions about data stewardship.- ĂykĂŒ IĆık
IĆık says that regulators, customers, and partners will increasingly expect credible quantum readiness. âI do not believe that customers, partners, and regulators would expect perfection, but they will expect credible preparation. âWe havenât startedâ will increasingly imply weak governance: failing to anticipate a foreseeable, material risk with long lead times.
âIn trust-based ecosystems, laggards become the weak link commercially through partner friction, operationally through interoperability issues, and reputationally through questions about data stewardship.â
Joining the board of a family business can be one of the most rewarding roles a director takes on, but it requires a different kind of due diligence. Beyond financials and formal...
Audio available
From Trump and transatlantic tensions to AIâs reality check and sustainabilityâs reinvention, Davos 2026 signals a shift toward values-based pragmatism....
Real influence in the boardroom comes not from power or persuasion, but from humility, clarity, and the courage to disagree, says JĂžrgen Vig Knudstorp...
Audio available
Amid continued turbulence and transformation, boards must be ready to tackle the unexpected in the year ahead to strengthen their digital and strategic resilience....
Explore first person business intelligence from top minds curated for a global executive audience