Adi Karisik, Vice President and Chief Technology Officer, Intelligence & Cyber, Amentum.
getty
In cybersecurity, the most dangerous crises often arrive slowly enough to be ignored. For years, the threat of quantum computing lived comfortably in the category of “interesting but distant.”
That comfort is gone. Major institutions are no longer treating the quantum threat as a far-off academic possibility. On January 16, 2025, Executive Order 14144 directed immediate federal action on post-quantum cryptography. Subsequently, the National Institute of Standards and Technology (NIST) finalized its principal post-quantum encryption standards and urged organizations to begin migrating.
The private sector is also moving: in March 2026, Google set a 2029 deadline for its own post-quantum cryptography migration, explicitly linking that timeline to progress in quantum hardware, error correction and factoring resource estimates. These shifting estimates are also driven by new quantum algorithms, such as the JVG algorithm, which severely reduce the number of qubits required to factor RSA keys.
Much of today’s digital security depends on public-key cryptography, specifically RSA and elliptic-curve cryptography (ECC). These protocols protect secure web browsing, online banking, e-commerce, VPNs, software updates, digital certificates and electronic signatures. They work because the underlying mathematical problems are effectively impossible for classical computers to solve at a useful speed. But sufficiently capable quantum computers are expected to change that.
That vulnerability points to "Q-Day," which is the moment quantum machines can defeat the cryptography supporting much of the modern internet. The greater danger, however, is that the trust layer of the digital world will begin to fail. If an attacker can break or bypass today’s public-key systems, the consequences go well beyond secrecy. Websites can be impersonated. Software signatures can be forged, certificates can become unreliable and secure sessions can be intercepted or spoofed. Quantum computing threatens not only confidentiality but authenticity itself.
That is the reason this is not merely an IT/OT issue. It is a systemic risk to the economy, government and national security.
This is where the concept of "quantum-proofing" becomes essential. A system is quantum-proof when it is designed so that a future, cryptographically relevant quantum computer cannot practically undermine its confidentiality, authenticity or integrity. But quantum-proofing is not the same as swapping one encryption algorithm for another. That is one of the most dangerous misunderstandings in the current debate. Post-quantum cryptography is necessary, but it is only one piece of a much larger transition.
CISA and NIST have stressed that organizations need a full quantum-readiness roadmap, which requires cryptographic inventories, supply-chain planning and structural migration strategies rather than a last-minute patch. Real quantum-proofing ensures proper generation of encryption keys, secure key storage, key rotation, certificate issuance and validation, revocation procedures, digital signing, e-signatures, device identity, hardware security modules and cryptographic agility across the entire stack.
A company may deploy a new algorithm and remain vulnerable if its certificates are legacy-based, its signing infrastructure is outdated or its vendors and embedded devices cannot support the transition. Google’s announcements reflect that broader reality: Beyond algorithms, they are working on quantum-safe HTTPS certificates and quantum-safe app signing workflows, showing that real migration reaches deep into browsers, certificate ecosystems, developer tooling and platform operations. While large cybersecurity firms are only just beginning this process, there are few companies that offer fully quantum-proofed cybersecurity stacks.
The urgency is heightened by a harsh reality known as “harvest now, decrypt later." Adversaries do not need to wait until a quantum computer is ready to act. They can steal encrypted data today and store it for future decryption. That puts long-lived secrets at immediate risk: military plans, intelligence data, diplomatic communications, financial records, health records, trade secrets and strategic corporate data. The government has warned that malicious actors may now target sensitive information, expecting to use future quantum capabilities to break today’s non-quantum-resistant cryptography.
The national security implications are obvious and severe; modern intelligence and defense systems depend on trusted communications, secure identity, authenticated software and protected command-and-control (C2) infrastructure. If those cryptographic foundations weaken, the result is not just espionage. It could mean forged updates, spoofed identities, altered records or deceptive instructions that appear legitimate. The NSA’s quantum-resistance guidance exists because national security systems cannot afford to discover too late that their trust architecture was brittle.
The financial consequences could be equally serious. Banks, payment systems, clearinghouses, market infrastructures and digital commerce all rely on authenticated connections, trusted certificates, signed transactions and secure archives. The G7 Cyber Expert Group, chaired by the U.S. Treasury and the Bank of England, has explicitly warned that financial authorities and institutions need a coordinated transition to quantum-resistant cryptography and greater cryptographic agility. When the institutions responsible for financial stability start publishing quantum roadmaps, the message is unmistakable: This is no longer theoretical.
The worst response now would be complacency, and the second worst would be panic; what is needed is disciplined urgency. Every major organization should already be inventorying where RSA and ECC are used, prioritizing long-life sensitive data, demanding quantum-readiness plans from vendors, modernizing PKI, testing post-quantum certificates and signatures and building crypto agility so systems can evolve without collapse. NIST has provided the standards, government agencies have provided migration guidance and large technology companies have started setting deadlines. The signal could hardly be clearer.
There is, however, a positive way to read this moment, as we have seen this kind of challenge before. Y2K was treated as a looming technology disaster, but in the end, catastrophe did not happen; not because the risk was imaginary, but because people prepared. Systems were audited, weak points were addressed and deadlines were met.
Quantum cybersecurity can follow the same path. If governments, banks, technology providers, critical infrastructure operators and enterprises act now, the transition can be orderly. If they wait, it will be chaotic. But if they move with the seriousness the moment demands, the quantum era need not become a security apocalypse. It can become another Y2K: a major threat that was successfully managed because the world chose to prepare before the deadline arrived.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。