Quantum readiness, how important is it to you

Quantum computing is being waved around as a big threat to our data security, to the point it really feels like a Bogeyman

For some organizations, it is a real and current threat that they need to be working on already.

For other organizations, a lot less so, but there are still steps to take. 

But what is the threat really? 

Quantum computing evolving rapidly, as a totally new and different way of computing than our current binary computing models.  We've gotten far enough in that progress to be starting to do really useful computations for some specific tasks but are not yet scaled up for production use.  They certainly won't replace our existing computing systems but will compliment of our environments while influencing them tremendously. Quantum computing is way further along in development than Fusion power by a wide margin.

The big threat it brings is that it can decode our current transport encryption and is increasingly cracking the older PKI systems and showing it can deal with even the current versions of actively used ciphers.  If you do any computer-to-computer communications, then it applies. 

How much you need to worry about it depends on two primary factors

A) What kind of secrets do you have to protect. We all have some, but what and where are they?

B) Software development. If your organization does any, then it needs to be factored in.

If your secrets are important enough and for long enough, then what is happening is that bad actors (lone 'hackers', criminal cybergangs, though to nation-state) are aiming to intercept that traffic now, to save it for later decryption. So, any PII, financial, security design, secret sauce ingredients, etc., all count, and you need to pay some attention to the issue.

So, the minimum we all need to pay attention to are simple prerequisites. The cyber-security basics need to be in place, that you have well enforced cyber-security training and effective patch-management practice. Just having the tools to do so in place, doesn't mean they are enforced and effective, and without those, there are still easier ways to attack you, and therefore become obstacles to being quantum ready rather than the assets they are perceived to be.

Once you have those basics in effective use, know what secrets you have and how they are accessed/transmitted.  It is those accesses and sending that are what can be captured and decrypted by those quantum computers in development, and those steps don't have to be done in the same day or year. 

PKI (Public Key Infrastructure) is the part of our systems that can be cracked and needs an upgrading as we outlined previously.

It is something we all consume via browsing the web, with many of us using services that includes PII (personal data), financials, and other secrets.  It is also the front lines that you can test those services you use. 

There are several tools, but the easiest and most basic test we've found at the time of writing this, is DigiCert's PQC Checker.  Some sites are ready, some are partially ready, some aren't there at all. In 2026 we just gently prod our banks, government agencies, and such that we see when they aren't ready. In another year we can be asking much tougher questions of "when will they be ready" as that front visible front is typically the easiest to do. 

The basic To-Do to be ready, is to make sure you software/systems that use TLS:

• Enable TLS v1.3
• Enable ML-KEM Key Exchange
• Automate certificate issuance