Post-Quantum Cybersecurity: No Longer a “Someday” Problem
Governments are moving fast on post-quantum security, and organizations that wait for regulation may already be behind.
The window between “future quantum risk” and “today’s cybersecurity planning” has narrowed sharply over the past year, and policymakers across the world’s biggest economies are no longer treating it as a distant concern.
Governments Are Leading the Charge
In August, the US Treasury launched a Quantum-Readiness Task Force for the financial sector, bringing together government bodies, financial institutions, and tech infrastructure providers around post-quantum cryptography (PQC) transition, vendor readiness, and digital asset risk. This followed two executive orders signed by President Trump in June — one boosting quantum computing development, the other directing federal agencies to shift to post-quantum cryptography by 2030 (and full authentication migration by 2031).
The US isn’t alone:
Europe — The European Commission has issued a coordinated roadmap pushing EU member states to begin PQC transition by the end of 2026, with critical infrastructure migrating by 2030.
France — ANSSI, the national cybersecurity agency, will stop certifying security products without quantum-resistant encryption starting 2027, expecting all government and critical-infrastructure purchases to be quantum-safe by 2030.
Japan — Through CRYPTREC, the government is embedding PQC into national standards and preparing for migration across public infrastructure.
Africa — While most nations haven’t adopted formal post-quantum strategies yet, momentum is building through initiatives like Rwanda’s Quantum Leap Africa and the Africa Quantum Consortium’s 2026 white paper on securing the continent’s digital backbone.
Why “State-of-the-Art” Now Means Quantum-Ready
Major EU regulations — DORA, NIS2, and the Cyber Resilience Act — don’t explicitly mandate post-quantum cryptography, but they do require “state-of-the-art” cybersecurity measures. Regulators are starting to spell out what that means in practice: the European Central Bank has told bank CEOs that PQC adoption must begin now, and Switzerland’s FINMA is requiring migration plans, cryptographic inventories, and protection against “harvest-now-decrypt-later” attacks.
The takeaway: compliance can’t rely on the absence of an explicit mandate. As standards evolve, “state-of-the-art” will increasingly be read as quantum-safe.
The Threat Is Getting Closer, Faster
Today’s quantum computers aren’t yet powerful enough to break modern encryption — but the timeline is shrinking. Google research in 2025 suggested the number of qubits needed to break RSA encryption could drop 20-fold, from 20 million to under a million. A March 2026 follow-up study with Ethereum and Stanford found that breaking elliptic-curve cryptography could require fewer than 500,000 qubits — another 20-fold reduction.
As the article puts it, this is a “Q-Day” moment organizations can’t afford to wait for — much like the early warnings before the 2020 pandemic.
Three Steps Organizations Can Take Now
The World Economic Forum’s Centre for Cybersecurity recommends:
Cryptographic inventory — Identify everywhere encryption is currently used.
Cryptographic agility — Build the ability to update algorithms without costly system redesigns.
Defence-in-depth — Layer protections, combining classical and post-quantum cryptography.
Notably, a FINMA survey of 60 Swiss financial institutions found that most already recognize the quantum risk — what’s missing is a clear migration roadmap.
The Randomness Problem
Even the strongest post-quantum algorithm is only as secure as the randomness behind its encryption keys. Weak “entropy” can let attackers narrow down a key without ever breaking the underlying math, and this vulnerability carries over to post-quantum cryptography too. The fix is verifiable entropy: randomness that can be measured and certified, not just assumed, with quantum entropy sources offering a physics-based way to prove it.
The US is moving through federal mandates, Europe through regulation and standards, Japan through national frameworks, and Africa is positioning to build quantum resilience into new digital infrastructure from the ground up. History suggests public-sector action shapes private-sector adoption. For organizations everywhere, the smartest move isn’t waiting for legislation, it’s starting the transition to quantum-ready cybersecurity now.
Source: World Economic Forum
