What is quantum risk? A practical guide for businesses

The security question is specific

A sufficiently capable quantum computer could undermine widely used public-key systems, including RSA and elliptic-curve cryptography. These systems help establish secure connections and verify digital signatures. The concern reaches beyond someone reading a private message: authenticating a software update or a business system also depends on cryptography. NIST explains this threat and the purpose of post-quantum cryptography in its public overview. [1]

The practical question for an owner is therefore: which important business activities rely on those mechanisms, and who is responsible for updating them? Listing every device without connecting it to an activity will make the project harder to prioritize.

Timing is uncertain; preparation can still be concrete

There is no established calendar date when quantum computers will break production public-key cryptography. NIST describes substantial technical uncertainty. A laboratory milestone, vendor roadmap, or qubit count alone does not demonstrate that an attacker can defeat the security of a particular business system. [1]

We suggest separating two decisions. First, choose useful work that can begin without a date prediction: name an owner, ask suppliers for plans, and identify long-lived sensitive information. Second, reserve larger replacement decisions for a documented technical and business review. This lets preparation progress without using a frightening countdown as a purchasing rule.

What post-quantum cryptography changes

Post-quantum cryptography, often shortened to PQC, uses algorithms intended to withstand classical and quantum attacks. NIST finalized ML-KEM for establishing shared secret keys and ML-DSA and SLH-DSA for digital signatures in 2024. These are distinct functions; enabling a new key-establishment option does not by itself replace every signature dependency. [2]

PQC is implemented in ordinary computing systems. It is different from quantum key distribution, which uses physical quantum techniques. A product described as quantum-safe still needs a precise explanation of its scope, implementation, configuration, and remaining dependencies. Ask which connection or function it protects, which version is needed, and how the provider verifies the result. [3]

Use a business-service starting point

Our suggested first exercise is to pick one service you could not comfortably lose for a working day. It might be customer file exchange, remote access, payment processing, or access to essential operational records. Write down who uses it, where information travels, what information remains sensitive, and which suppliers support it.

Then arrange a short discussion between the service owner and the IT provider. The desired result is one named person for each unanswered question and a next review date. Keep passwords, secret keys, and actual customer documents out of this planning worksheet.

• Identify the business activity and the systems that enable it.
• Ask which cryptographic dependencies are known and which require investigation.
• Record a vendor answer or technical finding, rather than a marketing label.

Connect security and insurance carefully

Maintain a separate list of questions for your insurance adviser: what event would trigger a relevant section of the policy, what costs could be considered, and what reporting obligations apply? A preparation plan can support an accurate discussion of your controls. It cannot establish coverage or guarantee a better premium.

Keep this work alongside your existing cybersecurity program. A new cryptographic algorithm does not address every way information can be stolen or a business can be disrupted. The useful outcome is a more informed technology plan and a clearer insurance conversation, with specific responsibilities on both sides.