For the past decade, quantum computing has been relegated to the horizon, a distant, theoretical challenge rather than an immediate operational imperative.
Breakthroughs have generated headlines, but without a firm deadline for when quantum computers could threaten today’s cryptographic standards, CISOs have had little incentive to make quantum readiness an immediate priority. IBM’s 2025 Quantum-Safe Readiness Index shows how much work remains, with the average organization scoring just 25 out of 100.
Yet, that window of preparation is contracting rapidly. This spring, Google warned that “quantum frontiers may be closer than they appear,” pointing to advances in hardware, error correction, and algorithms that are accelerating progress toward cryptographically-relevant quantum computers. Google has since set a 2029 target for completing its own migration to post-quantum cryptography (PQC).
Latest Videos FromTechRadar
Yet, that growing urgency still comes without a firm deadline. Unlike the fixed, binary deadline of Y2K from years ago, the quantum risk profile is nebulous; the exact threshold of peril remains undefined, even as the required remediation timeline spans several years.
Large enterprises need time to identify cryptographic dependencies, assess legacy infrastructure, coordinate vendors, and secure the budgets required for migration. Those decisions reach well beyond cryptography, affecting how the business plans, funds, and prioritizes risk. In fact, the availability of quantum computing capabilities will touch almost every aspect of companies around the globe.
Turn quantum risk into an enterprise-wide priority
Quantum readiness already has a prescribed technical solution. In 2024, NIST finalized its first set of PQC standards and encouraged organizations to begin transitioning as soon as possible. For some systems, migration may just involve a software update or configuration change. For others it may be much more complex. The challenge for a large enterprise is knowing where those changes need to happen.
A practical first step is to build a cryptographic bill of materials (QBOM), cataloging what cryptography is in use and where, which systems can be updated relatively easily, and where legacy infrastructure may require replacement or another mitigation strategy. This is an intensive effort, but there are software platforms that can help.
Next, organizations should prioritize systems based on the value of the data and how long it needs to remain protected. Financial records or customers’ customer personally identifiable information (PII), for example, may warrant greater urgency than an internal chat log with little long-term value.
Data longevity is especially important because adversaries are already collecting encrypted traffic in the expectation that future quantum computers will be able to read it, a practice known as “harvest now, decrypt later.” For sensitive data, the attack may already have happened even though the business impact hasn’t.
Data exposure is only one part of that assessment. Public key cryptography (PKC) also underpins authentication, including single sign-on and other mechanisms used to establish identity. If that cryptographic foundation can no longer be trusted, organizations face the risk of impersonation, with consequences for access to applications, infrastructure, and data.
Much of this work sits outside the CISO’s direct control. Infrastructure, applications, data, and third-party relationships are often jointly owned across the business, and so are many of the budgets needed to address them. CISOs must make a business risk pitch that shows other leaders – the CIO, CTO, procurement, compliance, and executives – where the greatest risks are and what needs attention first.
Make crypto-agility part of the migration
Preparing for a post-quantum future also requires crypto-agility. Cryptographic standards will continue to evolve as new vulnerabilities emerge and algorithms change. Organizations need systems and platforms that can accommodate those changes without another costly, multi-year migration. That means buying and building in ways that can accommodate a future algorithm change through software rather than hardware rip-and-replace.
The UK’s National Cyber Security Centre recommends building that flexibility into PQC migration plans and establishing criteria for retiring traditional algorithms, with the goal of removing sole dependence on traditional public-key cryptography. It also means rethinking how organizations budget for the transition.
Large enterprises often operate on annual budgets approved well in advance and adjusted only slightly throughout the year, but a post-quantum transition may require more flexibility as standards and threats evolve.
This principle should also influence procurement. SOC 2 compliance already requires organizations to scrutinize vendors’ privacy policies, certifications, and access controls, but cryptographic dependencies can be another blind spot. Asking which standards a vendor supports, how cryptography can be updated, and what its PQC roadmap looks like can reduce the risk of buying infrastructure that becomes difficult or expensive to migrate later.
The quantum timeline starts with today’s budget
While a firm deadline for quantum readiness remains elusive, budget cycles offer a more disciplined, actionable framework for planning. Executing a multi-year migration requires sustained financial commitment over successive cycles; every passing budget period effectively compresses the available window for remediation.
Most CISOs already understand quantum risk. The challenge is moving quantum readiness from something planned for next quarter or next year into funded work. With only a limited number of budget cycles available for a multi-year migration, repeated delays quickly add up.
The priority is to turn that awareness into an inventory, clear business priorities, and a phased migration plan that can be funded over the coming budget cycles. By starting now, organizations have time to focus on the highest-risk systems and address legacy infrastructure before the timeline becomes critical.
We’ve featured the best web hosting services.
This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.
The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit
