Large-scale quantum computers do not exist yet, but the encryption that protects your data today may not survive them. Standards bodies and governments have already started the switch to post-quantum cryptography. Businesses that plan now will find the change routine. Those that wait could face a rushed, expensive migration.
Why quantum computing threatens encryption
Most secure connections, digital signatures and VPNs rely on public-key algorithms such as RSA and elliptic-curve cryptography. A sufficiently powerful quantum computer running Shor’s algorithm could break them.
Nobody knows exactly when such a machine will arrive. Security agencies treat it as a matter of when, not if, and plan on a timescale of years rather than decades.
Harvest now, decrypt later
The threat already matters today. Attackers can record encrypted traffic now and store it until they can decrypt it. Any data that must stay confidential for many years, such as health records, financial data, intellectual property and government contracts, is already at risk.
The new standards
In August 2024 the US National Institute of Standards and Technology (NIST) published its first post-quantum standards: FIPS 203 (ML-KEM) for key exchange, and FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) for digital signatures. In 2025 NIST selected HQC as an additional backup algorithm.
NIST’s draft transition plan proposes deprecating today’s vulnerable algorithms by 2030 and disallowing them by 2035. Major browsers and cloud providers have already started using hybrid post-quantum key exchange for web traffic.
A practical roadmap
1. Build an inventory. List where your business uses encryption: websites, VPNs, email, databases, backups, payment systems, certificates and third-party software.
2. Rank by risk. Prioritise systems that protect long-lived sensitive data or are hard to update.
3. Ask your vendors. Find out each key supplier’s post-quantum plans and timelines. Most of your migration will arrive through software updates.
4. Design for crypto-agility. Make sure new systems can swap algorithms without a rebuild.
5. Pilot hybrid modes on non-critical systems as your vendors support them.
What small businesses should do now
You do not need a quantum team. Keep systems, browsers, operating systems and network equipment up to date, because that is how most post-quantum protection will arrive. Choose hosting, VPN and cloud providers that publish a post-quantum roadmap. Add encryption readiness to your annual security review.
Raamello includes encryption and crypto-agility checks in our cybersecurity audits and network upgrades. Book a security review to see where you stand.