CISOs and security teams are already contending with a deeply complex threat landscape, which has become defined by AI weaponisation and increasingly frequent attacks. In addition, cyber attacks are being executed with greater speed and precision, as seen with the recent ASOS customer data hack.
However, the greatest security threat, and the one which poses a long-term threat to an organisation’s ability to operate ‘business as usual’, is already clear. This threat manifests itself with the arrival of Q-Day, the point at which quantum computers become capable of breaking today’s widely used encryption, which could come as soon as 2029. But this does not mean that it is a future threat. Cybercriminals are already collecting encrypted data today with the intention of decrypting it once sufficiently powerful quantum computers become available, meaning quantum-enabled attacks are already in the early stages of execution.
With Cybersecurity Awareness Month putting the spotlight on a multitude of emerging threats, experts from DigiCert, F5 and Arqit explore why quantum readiness must be a strategic priority for organisations today, the progress already being made and the practical steps organisations can take to protect their data in the long-term.
Maintaining digital trust
The foundations of digital trust are changing. Lifecycles on digital trust certificates are shortening, leaving organisations to face growing pressure on how they can secure their cryptography in a rapidly changing trust environment.
For Paul Holt, Group Vice President, EMEA at DigiCert, this creates a new set of challenges, which are grabbing the attention of CISOs, “AI agents are taking on business tasks faster than many organisations can establish oversight. Public TLS certificate lifespans are shrinking toward a 47-day maximum by 2029, making manual management increasingly difficult. And with post-quantum cryptography standards in place, organisations need a plan to replace cryptography that future quantum attacks could break.”
While these developments present different challenges, they share a common requirement: organisations need greater visibility and control over the systems and identities they depend on.
It is also vital that senior leaders are aware of what their organisations rely on when it comes to certificate management, Holt offers advice on this, saying, “CISOs need to know where certificates and cryptographic algorithms are used, which AI agents can act on the organisation’s behalf, and who controls them. They also need to be able to renew certificates, replace algorithms, or revoke an agent’s authority when circumstances change.”
Establishing this visibility is a critical first step towards protecting sensitive data from future quantum weaponisation. However, without a clear understanding of where cryptography sits, organisations risk overlooking vulnerable assets.
Progress is being made, but gaps remain
The migration journey for many organisations is already under way, as it should be, but with a full transition potentially taking several years, organisations need to start today if they are to become quantum-ready in time. The good news is that progress is already being made across many online sites. Emerging standards and the adoption of quantum-resistant technologies are helping to lay the groundwork for a more secure digital environment.
David Warburton, Director at F5 Labs, points to recent research demonstrating the growing adoption of post-quantum protection across the web. However, Warburton highlights that the findings also reveal why adoption figures do not necessarily tell the full story: “On the face of it, the web is making real progress on post-quantum security. Our latest research found that 54% of the world’s top one million websites now support a post-quantum key exchange. But the devil is in the detail, because much of that protection has been switched on by content delivery networks on behalf of their customers. Exclude Cloudflare-hosted sites from the sample, and adoption falls to 22%.”
This reveals an important distinction between simply having post-quantum protections in place and achieving genuine quantum readiness across wider infrastructure. As Warburton explains, “It helps protect traffic between a visitor and a website from being captured today and decrypted in the future. What it cannot tell us is whether the connections behind that website have been upgraded too. An organisation might have post-quantum protection at its public edge while its internal applications, APIs and connections to partners continue to use older cryptography.”
However, Warburton also stresses that the uncertainty surrounding the exact arrival of Q-Day should not become a reason to delay this work: “Nobody can put a reliable date on when a quantum computer will be able to break today’s encryption. But organisations don’t need that date to start preparing. The sensible first step is to identify where they use cryptography, particularly where sensitive information needs to remain confidential for years. They can then work out which systems and suppliers will take longest to update and plan accordingly”.
Building resilience through cryptographic agility
However, according to Jonathan Nguyen-Duy, Chief Technology Officer at Arqit, identifying vulnerable systems and upgrading existing cryptography is only part of the challenge. However, there is an element to the quantum threat which gives organisations a headstart, “Unlike other potential cyber risks, this is a threat that we know is coming, so organisations cannot simply assume that it won’t happen and hope for the best”.
As cryptographic standards and compliance requirements continue to evolve, organisations need a shift in mindset. Rather than treating post-quantum migration as a one-off security project, businesses need to build the resiliency and agility to enable smoother future transitions. As Nguyen-Duy explains, “Businesses must ensure they are resilient enough to deal with these evolving threats, by regularly questioning whether the security assumptions the business relies on still hold true, including the cryptography underpinning trust in its data and systems. True agility, and therefore resilience, means building infrastructure that can adapt before today’s protections become tomorrow’s weaknesses”.
Achieving a state of crypto-agility means moving away from an approach where replacing cryptography has required extensive manual intervention or planning, to a scenario where this can be done in smoother, more efficient way. Organisations should work towards implementing the infrastructure that allows cryptographic technologies to be updated as part of routine security operations.
Looking ahead
Just as Y2K demonstrated the importance of preparing for technological disruption before it happens, experts across the quantum security sector agree that organisations cannot afford to wait for Q-Day before taking action.
Although the scale of the transition may appear daunting, the first step is often the easiest. By identifying where cryptography is used, understanding which systems and data are most exposed and prioritising the dependencies that will be hardest to migrate, security leaders can begin building a practical roadmap towards comprehensive quantum readiness.
But the real measure of success will extend beyond the initial migration to post-quantum cryptography. Organisations must reach a point where cryptographic change is no longer a major transformation project, but a routine part of maintaining security and resilience.
If they do this, organisations can ensure they are equipped to safeguard data, maintain the digital trust businesses depend on and continue to operate business as usual.
Join our LinkedIn group Information Security Community!
