The Quantum Threat Is Already Here

Quantum computing presents a problem that businesses cannot afford to leave for another decade.

Encrypted data stolen today could become readable in the future if quantum computers become powerful enough to break the cryptographic systems protecting it. For organisations holding sensitive information, the risk depends not only on when that technology arrives but also on how long the data needs to remain confidential.

Moona Ederveen-Schneider is a cybersecurity strategist, post-quantum specialist, and founder of Resilia Connect. A former executive director for EMEA at FS-ISAC, she has spent more than 20 years leading cybersecurity and risk programs for major financial institutions. She is also the author of the Practical Post-Quantum Transition Framework and founder of the Quantum Security Connection.

In this interview, Ederveen-Schneider explains why businesses need to approach post-quantum migration as an organisation-wide effort, why data protection should shape the starting point, and how readiness is beginning to affect commercial relationships.

The quantum threat is already shaping security decisions

The concern is not simply that quantum computers might one day undermine encryption. Attackers can collect encrypted information now and retain it until the technology needed to decrypt it becomes available.

That creates a difficult question for businesses: could data that appears adequately protected today expose the organization years from now?

People often think of quantum computing as a future concern. Why should businesses be worried about it today?

Moona Ederveen-Schneider: “Absolutely. What we must realise is that this is not a future threat. It is happening right now. Adversaries are harvesting encrypted data today, waiting to decrypt it once quantum computers are powerful enough.”

“I also run tabletop exercises teaching organizations how to become crypto-agile. In these Quantum Security Connection sessions, I poll participants at the start and again at the end. The shift in the room is remarkable. People arrive feeling that the problem is unmanageable and leave confident, knowing exactly what to do next.”

For CTOs, the important distinction is between the arrival of a quantum computer capable of breaking current cryptography and the information that may already be exposed to future decryption. A business holding sensitive records that must remain confidential for decades faces a different risk from one whose data loses its value within months.

That difference should influence the order in which organisations assess their exposure. Waiting for a definitive date for quantum capability could leave too little time to deal with systems that are difficult to replace and data that cannot simply be taken out of circulation.

Why 2035 is not a sensible starting point

A migration deadline can look distant on a calendar. It looks much closer when an organisation has to map cryptographic dependencies, assess suppliers, replace legacy components, test systems, and coordinate changes across multiple teams.

The NCSC has set migration milestones, and Google is targeting 2029 for its own transition. Are businesses leaving it too late to prepare?

Moona Ederveen-Schneider: “The UK National Cyber Security Center says organizations should complete detailed planning by 2028 and be fully migrated by 2035. Google has set its own internal full migration deadline of 2029.

“They cite faster-than-expected advances in quantum computing, and that is the sentiment I see across the board, reflected in strong government guidance globally. Google is one of the organizations building these machines, so its move deserves serious attention.”

“Large organizations typically need at least five years to complete a full cryptographic overhaul, and some need double that. So 2035 is by no means generous. We have to take action now. My practical post-quantum transition framework is designed to start delivering security improvements from day one. It tells you where to start and how to make it through without overloading your teams or budget.”

“You’re not just building for a future problem in isolation. You’re building a more resilient architecture today that also protects against current threats such as ransomware, AI-enabled attacks and supply chain compromise.”

The challenge for technology leaders is finding room for this work alongside existing commitments. Infrastructure upgrades, cloud migration, application modernisation, and day-to-day security demands already compete for engineering time and funding. Post-quantum migration has to fit into that reality.

There is also a discovery problem. Organisations may not have a complete picture of where cryptography is used, especially across older applications and third-party services. Until those dependencies are understood, it is difficult to estimate the scope, cost, or duration of the transition.

The practical response is to start planning before every technical detail is known. A first assessment can establish ownership, identify the systems that need closer attention, and give leadership a more credible basis for deciding what to fund next.

Why the first question should be about data

It is tempting to begin a post-quantum program by cataloging algorithms, certificates, and encryption systems. That work matters, but it does not tell leaders which information would cause the greatest harm if it were exposed years later.

When a company starts preparing for the quantum threat, where should it begin? You argue that protecting the right data matters more than starting with a cryptographic inventory. Why?

Moona Ederveen-Schneider: “The first common mistake is treating post-quantum cryptography migration as a technology project and handing it to the security team. It is not a technology project. It’s a whole transformation. The data that needs protecting sits in HR, legal and finance, not just in what DORA calls critical business processes.

“The second common mistake is starting with the cryptographic inventory. Contrary to the mantra that everyone repeats, I advise organisations to enhance their data security posture first to become quantum-secure.”

Organizations must answer the business question: what are we protecting, and how long does it need to stay secret? My practical post-quantum transition framework starts there and is designed to deliver security improvements from day one. It is adaptable for any size organisation and any size team.”

The distinction matters because cryptographic migration is not just a list of technical replacements.

A company needs to know which records, transactions, communications, and intellectual property require long-term confidentiality before it can make informed choices about priorities.

That information often sits outside the security function. Legal teams may understand confidentiality obligations; HR and finance teams know what sensitive records they hold; procurement teams manage supplier relationships; and technology teams understand how applications depend on cryptographic systems.

A useful migration plan has to bring these perspectives together. The inventory remains part of the work, but the business risk helps determine where to focus first.

How organizations can learn from one another

For companies that have not started, the post-quantum landscape can be difficult to navigate. Teams must keep up with standards, assess vendor claims, and work out which actions make sense for their own infrastructure. They may also lack colleagues with direct experience of a transition on this scale.

Many organisations know they need to prepare but don’t know where to start. How are the Quantum Security Connection and the Quantum Security Intelligence Report helping them move forward?

Moona Ederveen-Schneider: “In my industry conversations, I kept seeing the same pattern.”

“Organizations wanted to move on post-quantum cryptography, but they felt isolated. They did not know where to start or what their peers were doing. They couldn’t assess the vendor landscape effectively, and they struggled to stay current as regulation and standards evolved.”

“That’s why my Quantum Security Connection network brings together cross-sector practitioners from public and private organisations and critical national infrastructure. I run structured quantum preparedness tabletop exercises. People arrive feeling that the problem is unmanageable, but afterwards they feel confident, with a clear plan and a peer network they can lean on.”

“I also published the Quantum Security Intelligence Report, which came out of the same insight. This community needs a shared, trusted source showing what is happening to help practitioners cut through the hype and separate signal from noise.”

The value of a preparedness exercise is that it gives teams a chance to work through a problem before they are dealing with a real incident or a deadline. A discussion can expose unclear responsibilities, gaps in supplier information, or assumptions about who would make decisions during a transition.

Peer networks can also help organisations compare approaches without assuming that a solution used elsewhere will fit their own environment. For a CTO, the aim is to use external insight to inform decisions while keeping priorities tied to the company’s own systems, obligations, and risk exposure.

The business case goes beyond security

Security investment is easier to defer when the risk feels distant and the cost is immediate. That calculation can change when customers, suppliers, insurers, and procurement teams begin asking what an organization is doing to prepare.

Beyond reducing security risks, can getting ready for the quantum era give businesses a commercial advantage?

Moona Ederveen-Schneider: “The organizations that get this right will be safer and ahead. Early adopters in financial services and pharmaceuticals are already extracting value from quantum computing, not just bracing for the risks.

“Understanding the technology positions you to benefit from it, not merely survive it. That’s why I’m working on a white paper called Practical Quantum Mechanics.”

“As with any complex transformation, starting a structured migration on time means less last-minute scrambling, lower overall costs and readiness when regulation arrives, rather than a reactive, expensive catch-up.”

“The cost of doing nothing can be quantified, and I talk about that in my Cambridge University programme. My practical post-quantum transition framework is designed to help organizations achieve this competitive advantage.”

For enterprise technology leaders, the commercial case is closely tied to being able to explain risk and demonstrate that it is being managed. A clear plan can give customers and business partners more confidence than a general assurance that the organisation is monitoring quantum developments.

Early planning may also give companies more control over the cost and timing of change. They can identify dependencies, coordinate work with existing modernization programs, and avoid making rushed decisions when a supplier or regulatory requirement forces the issue.

The extent of the commercial advantage will differ by sector. The underlying management question is consistent: can the organisation explain what it needs to protect, what it is doing about the risk, and how it will move forward?

Turning awareness into a first step

The challenge with emerging technology risks is not always a lack of information. Sometimes the information is so broad and the possible consequences so large that teams struggle to turn awareness into a concrete plan. That is where practical guidance and exercises can help.

If a CTO or business leader hears you speak today, what’s the first thing you’d want them to do when they get back to work on Monday?

Moona Ederveen-Schneider: “It is important to me that audiences leave energised and ready to act. Two things are key to that: making complex topics clear and accessible, and engaging the audience, especially with topics such as quantum and AI risk.”

“My job is to cut through the hype and give clear, actionable guidance. I never pander to fearmongering. I make sure the audience leaves with something practical in their toolkit: a Monday morning action. That is how we achieve change that matters.”

“As a frequent conference visitor, I think it is critical for a speaker and moderator to provoke new thoughts and outcomes. That means challenging the status quo and the comfortable assumptions heard at many conferences. Occasionally, I want to make people laugh because we’re humans, not machines.”

“I’m also known for helping audiences connect with each other. As a facilitator, it is my job to get people off their phones and into the real world, interacting with each other and the conference content.”

“We need to build our network in quiet times so that we can rely on each other when it all falls down.”

For a CTO, the first step need not be a major procurement decision or a full-scale migration program. It can begin with bringing security, infrastructure, application, legal, and business stakeholders together to identify the data that must remain confidential and the systems that protect it.

That conversation can help establish what the organisation knows, where the gaps are, and who needs to take responsibility for closing them. The work will take time, but understanding the exposure is a more useful starting point than waiting for a clearer signal from quantum computing itself.

In brief

• Encrypted data can carry a long-term risk. Information stolen now may remain valuable to attackers even if they cannot decrypt it yet.
• Migration needs business ownership. Security teams cannot plan the transition alone when sensitive data and cryptographic dependencies span the entire organisation.
• A cryptographic inventory is not the whole starting point. Businesses first need to understand what they must protect and for how long.
• Waiting has business consequences. Migration can take years, while customers, insurers, and procurement teams may increasingly ask organizations to demonstrate preparedness.