Quantum is coming: What every board needs to do now

Microsoft has been one of the latest to put an estimated timeline on the arrival of a commercially viable quantum computer, predicting it will be as early as 2029. For businesses, that’s as little as ten quarterly board meetings away.

Every new prediction reignites debate about when Q-Day will finally arrive, but what’s more pressing is the preparation window it gives businesses.

Quantum readiness is not something organizations can achieve overnight. By the time a cryptographically relevant quantum computer arrives, businesses will already need to have identified vulnerable systems, mapped critical data and begun their migration. Q-day isn’t when preparation starts, it’s when preparation will be judged.

Treating quantum as tomorrow’s problem risks repeating a mistake many organizations made with Y2K. Boards need to recognize it as a critical business risk. The debate about timelines is a distraction we cannot afford when we know there may already be adversaries out there collecting data to decrypt at a later date.

How trust in business data could be swept away overnight

For long lived data - such as financial records, intellectual property or identity data - the risk doesn’t just begin when a quantum computer is able to break today’s encryption. The risk already exists through ‘harvest now, decrypt later’ attacks, where adversaries collect encrypted data today with the intention of decrypting it once sufficiently powerful and viable quantum computers become available.

Many businesses brush off this potential risk for one of two reasons. Some assume that even if encrypted data is being harvested, the sheer volume involved limits the threat. But what they might not have considered is the power of AI and quantum working together.

AI has made it possible to sift through terabytes of data almost instantly, helping to identify high-value information at scale. And that’s exactly what bad actors will do once quantum is available to break the encryption.

Others assume they’re not…