Governments, financial institutions and technology companies are preparing digital systems for a quantum threat that could put today’s confidential data at risk.
A major security upgrade is taking shape beneath the surface of the digital economy. Governments, banks and technology platforms are preparing to replace vulnerable cryptographic systems with post-quantum cryptography, or PQC—mathematical techniques designed to withstand attacks from future quantum computers.
The transition gained a practical foundation in August 2024, when the US National Institute of Standards and Technology finalized its first three PQC standards. They cover establishing shared secret keys and creating digital signatures, essential functions underpinning secure communications and trusted software. NIST made the standards available for immediate use.
The concern is specific: a sufficiently powerful quantum computer could defeat widely used public-key systems, including RSA and elliptic-curve cryptography. PQC provides alternative algorithms that run on conventional computers; organizations do not need quantum machines to deploy them.
The urgency comes partly from a threat known as “harvest now, decrypt later.” An adversary could collect encrypted information today and retain it until quantum technology makes decryption possible. Information that must remain confidential for many years could therefore be exposed even if the breakthrough arrives well into the future.
US security agencies have warned that attackers could already be targeting data with long confidentiality requirements. That warning supports early action, although it should not be confused with public proof of particular harvesting campaigns or successful quantum decryption of modern systems.
Deployment is already moving beyond academic research. Google has reported using post-quantum cryptography to protect internal communications since 2022 and extending post-quantum key exchange to connections between Chrome and its services. Such changes can strengthen protection without requiring users to alter how they browse or access email.
Financial institutions are also testing the operational consequences. In December 2025, the Bank for International Settlements published findings from the second phase of Project Leap, which tested post-quantum digital signatures in an operational payment system. Participants included European central banks, Swift and Nexi-Colt. The experiment required changes across multiple components and revealed performance differences that warranted further testing. It demonstrated progress, rather than a completed transition across banking.
The largest challenge may be coordination. Organizations must locate vulnerable cryptography across hardware, software and services, identify their most sensitive dependencies and work with suppliers to replace them. NIST’s migration program emphasizes discovery and prioritization as foundations for that process.
The UK’s National Cyber Security Centre illustrates the timescale involved: its roadmap sets targets for discovery and planning by 2028, priority migration activities by 2031 and completion by 2035. These are preparation milestones, not predictions of when a quantum computer will break existing encryption.
For organizations holding long-lived secrets, the practical deadline depends on both how long their information must remain private and how long their systems take to replace. The work must begin early enough to protect data before it becomes part of an adversary’s archive.
Sources:
