Preparing for post-quantum cryptography: Building a practical roadmap

The conversation around post-quantum cryptography (PQC) has shifted. Organizations are no longer asking whether they should prepare for quantum computing, but how quickly they can execute a migration that many expect will take years to complete.

As technology providers accelerate their roadmaps, governments introduce new expectations and boards seek greater assurance over cyber resilience, quantum readiness has become a business priority rather than a future technology project.

That urgency is being driven from several directions. Google and Microsoft have both set out roadmaps that point towards 2029 as a significant milestone in the transition to quantum-safe cryptography, while the recent US Executive Order on strengthening national cyber security reinforces the expectation that organizations begin preparing for the post-quantum era.

Together, these developments are shortening the planning horizon and increasing the pressure on CISOs to move from strategy to execution.

That shift from awareness to execution is reflected across the industry. Gartner's 2026 CISO Role-Based Survey: State of the Union found that fewer than one in four organizations have made measurable progress towards quantum readiness and only 8% have a usable cryptographic inventory.

DigiCert’s own Quantum Readiness Outlook research tells a similar story, as most IT and security leaders expect quantum computers to be capable of breaking today's encryption methods within the next three to five years, yet only 7% report that more than half of their digital certificates are already quantum-safe or hybrid.

The greatest challenge organizations face is no longer understanding the risks posed by quantum, but instead about becoming quantum-ready before today's cryptography becomes tomorrow's liability.

Why the risk is already here

Quantum computing has the potential to deliver significant advances across science, medicine and artificial intelligence, but it also threatens the asymmetric cryptography that secures digital identities, software, financial transactions and communications. The concern is no longer confined to the arrival of a cryptographically relevant quantum computer.

Threat actors are widely believed to be adopting a harvest now, decrypt later (HNDL) approach, collecting encrypted data today with the expectation that it can be decrypted once quantum capabilities mature. For organizations protecting information with a long operational life, that changes the timeline completely.

Our data found that 84% of organizations believe at least some of their encrypted data is vulnerable to HNDL attacks. Financial transaction records and banking data were identified as the assets most at risk (58%), followed by cryptocurrency wallets and private keys (53%).

For CISOs, this provides an important starting point because rather than attempting to replace every cryptographic system simultaneously, the priority should be identifying the systems protecting long-lived, high-value information and focusing migration efforts where the business impact would be greatest.

Discovery before deployment

For many organizations, the greatest challenge is not selecting quantum-resistant algorithms, but understanding where vulnerable cryptography exists across the business.

Furthermore, cryptography underpins cloud infrastructure, enterprise applications, connected devices, operational technology, software signing and countless machine identities. Over time, certificates, keys and algorithms become distributed across complex environments, often without a complete inventory of where they are used or which business services depend on them.

This is why discovery should be the first stage of every quantum readiness program. Organizations cannot prioritize risk, assess dependencies or build a realistic migration roadmap without first understanding their existing cryptographic estate. Discovery also enables security teams to identify the systems protecting their most valuable assets, allowing them to focus investment where it will have the greatest impact.

Once that foundation is in place, organizations can begin introducing quantum-resistant algorithms alongside existing infrastructure, testing interoperability, prioritizing critical systems and building the crypto-agility needed to adapt as standards continue to evolve.

Building a practical roadmap

Preparing for post-quantum cryptography is not a single technology upgrade, in fact, it is a long-term business transformation program that requires collaboration across security, infrastructure, application teams and technology partners.

The discovery stage provides the foundation by revealing where cryptography is deployed, exposing hidden dependencies and identifying systems that may otherwise be overlooked. Those unknowns are often the biggest source of delay, making early discovery essential to building a realistic migration roadmap.

With that understanding, organizations can begin prioritizing the systems that present the greatest business risk while assessing whether their wider technology ecosystem is ready for the transition.

That means working with software, hardware and cloud providers to understand their post-quantum roadmaps, identifying platforms that will require upgrades, and reviewing critical infrastructure, including web servers and TLS implementations, to ensure they can support quantum-safe cryptography.

It is important to remember that cryptographic standards will continue to evolve, making automation and crypto-agility essential for managing certificates, keys and algorithms at scale and adapting to future change.

The organizations that succeed will not be those that wait for quantum computing to arrive, but those that begin preparing now. By uncovering the unknowns within their cryptographic estate and building a phased migration strategy based on business risk, CISOs can strengthen resilience today while preparing their organizations for the cryptographic challenges of tomorrow.

We've featured the best business computer.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit