How seriously is your business taking the 'Q-Day' threat, and can you really be ready by 2029?

The pace of progress on quantum computing isn't slowing down, but so many businesses still haven't prepared for the looming threat – with experts now shifting their rhetoric toward damage limitation

By Keumars Afifi-Sabet

Published 2 September 2026 In Features

Quantum computing concept image showing three purple-colored, glowing blocks placed on top of circuit boards with connected data flows. — (Image credit: Getty Images)

If you can cast your mind back to 1999, the computing world was in a frenzy over the Y2K bug, or Millennium Bug, a coding flaw where systems abbreviated four-digit years to two digits – so, 99 instead of 1999.

First identified in 1958, the fear was that computers would read '00' as 1900 instead of 2000, potentially crashing global infrastructure. As such, $300 billion (now worth a staggering $600 billion in today's money) was spent to upgrade computers and application programs so they were Y2K-compliant. Because of this monumental effort over many years, the crisis was largely averted.

In 2026, a similar panic is simmering at a glacial pace. The fear is Q-Day: a hypothetical moment at which quantum computers become so powerful that they can crack encryption algorithms within seconds. Leading industry figures, quantum computing companies, cybersecurity advisors, and even national government agencies have been warning about this moment for years — as far back as 1994, when mathematician Peter Shor first published his paper warning about this exact possibility.

Since then, the threat has felt far away and abstract – with under-pressure businesses spending their precious IT budgets on more immediate threats.

How prepared are we for a post-quantum world?

Existing research into business preparedness is incredibly bleak. The vast majority (90%) of companies don't have systems in place to defend against quantum security threats, according to Bain & Company analysis. It's a similar, albeit less extreme, story with Keyfactor research that shows nearly half (48%) aren't ready.

Juniper Research found that just 27% of global companies will deploy PQC – but only by 2035. Right now, that figure stands at roughly 0.0009%, or just 35,000. Compound these findings with QuEra research that showed the level of confidence in quantum preparedness actually fell from 65% to 55% between 2025 and 2026, meaning that as the threats become less abstract, businesses are increasingly aware that the measures they've taken may not be sufficient.

There's a readiness gap – no matter how you interpret the many and various findings. But what does this actually mean in practice and why is there such a large gap? Knowledge is the primary deficit, says Arjun Kudinoor, a doctoral student and NSF Graduate Research Fellow at MIT, as well as quantum security advisor at Protegrity. Many organizations lack the required expertise to understand the risks, prepare existing systems, and identify valuable applications, according to Kudinoor.

"Businesses must begin developing quantum literacy across technical and executive teams, assessing their exposure to quantum-enabled cybersecurity threats, and identifying problems for which quantum computing could provide a meaningful advantage," he adds.

But according to Orange Business' quantum-safe network lead and program director of edge computing, Frank de Jong, awareness has increased significantly in the last few years.

He tells ITPro: "It is impossible to be quantum-ready today, and in my opinion, it is also questionable if you could be completely quantum-safe before 2029. That's why we advise customers to start planning now and prioritize protecting their most valuable assets first. The key is to begin the journey, not to wait for perfect conditions."

As things stand, some sectors are more prepared than others. The earliest movers were telecoms providers and infrastructure-heavy organizations, with financial services, healthcare and software providers following suit. But it's also true to say that preparedness varies more based on resources and expertise, adds Kudinoor. He explains that firms with strong technical teams, quantum-related budgets, and executives concerned about planning for the threat are moving the fastest.

Avoiding a slow-motion quantum disaster

Quantum computing is difficult to wrap your head around, and it's long been a technology that's some years away from maturation. For that reason, it might be tempting for many to have kicked the issue deep into the long grass. Suja Viswesan, IBM VP of security software, acknowledges this impact. "It can feel overwhelming at the sheer magnitude of possible impact. But the best place to start is by gaining visibility. You can’t fix what you can’t see."

Businesses, she says, should start small by mapping cryptographic assets – including certificates, secrets and API keys – across their environments. Then, they should prioritize risk and introduce controls such as proxy layers to, as she puts it, "buy time" before full PQC upgrades are available.

Kohinoor rejects the notion that quantum computing's threats are abstract, telling ITPro: "Much work has been done to estimate the number of qubits, error rates, and error correction methods required to implement such quantum factoring algorithms on quantum hardware."

The most powerful quantum computers commercially available are only one or two orders of magnitude away from breaking encryption schemes like RSA-2048. Thankfully, he adds, it's "not yet a disaster" because we are still several difficult breakthroughs away from achieving a fault-tolerant cryptographically relevant quantum computer.

So what's to explain the general malaise in preparing for this eventuality? The answer may lie on the balance sheet – and the IT and security budgets that so many organizations are under pressure to spend on far more immediate threats.

Although IT spending is expected to hit $6.37 trillion this year, 14.2% higher than last year's spend, much of this has been allocated toward either trendier areas or toward more concrete threats. As de Jong puts it, IT budgets are spent "on where the center of attention is".

"In recent years, this was predominantly AI, and still today, this is where the majority of the “additional” money gets spent," he explains.

"Transitioning to quantum-safe infrastructure isn't a simple project. It will require substantial, sustained investment over many years. The most urgent call to action for CXOs today is to start planning and allocating substantial budgets for the coming years. This isn't fear-mongering — it's pragmatism. We cannot afford to wait and see."

Is it too late to prepare for the post-quantum world?

The urgency is certainly there, and many experts fear it's far too late to avoid the damage – especially given the rise of "harvest now, decrypt later" (HNDL) attacks – in which cybercriminals steal encrypted data with the intent of cracking it in the years to come using quantum computers.

But even if that were the case, there's still far more damage that can be done if businesses are sluggish about getting their defenses sorted. In that vein, the experts we interviewed say it's never too late to prepare.

"As the saying goes, ‘The best time to plant a tree was 20 years ago. The second-best time is now.’ The challenge with cybersecurity threats is that they may or may not affect you, but the fact that they could is sufficient reason to pay attention," de Jong says, but concedes that many will never be fully prepared.

"Most organizations face 15 years of work to become quantum-safe, but they may have only three years to do it. This means that they need to prioritize and accept the fact that not every asset can be defended at the same level from the start."

In the last few years, the mood has certainly shifted away from maximum preparedness to damage limitation as the reality has hit the industry that businesses haven't been moving quickly enough. MIT's Kudinoor advises businesses to upgrade all systems to PQC, beginning with the highest priority and most publicly available systems.

But the reality is that the threats themselves won't all hit at once – despite the 'Q-Day' label implying there's a single moment in the future beyond which there's no return. As IBM's Viswesan explains: "We’ll see it materialize over time, spanning multiple years as different cryptographic systems become vulnerable at different times."

Quantum readiness is all about making haste slowly

Given the gradual and unfolding nature of 'Q-Day', businesses should avoid rushing their decision-making and adopt a balanced and thoughtful approach, whether that's in assessing their estate or engaging with vendors.

The name for this dilemma – in which you need to act fast but not so fast that you end up making poor decisions – is "festina lente", a Latin term that roughly translates to "hurry slowly". But that's easier said than done.

"Organizations shouldn't wait to begin the transformation journey, but they also shouldn't rush into decisions. That’s where crypto-agility comes into play," Viswesan continues.

"Crypto‑agility is the ability to migrate to post-quantum cryptography (PQC), while maintaining the flexibility to make changes without business disruption. Crypto‑agility allows organizations to scale cryptography‑based data protection with confidence, reduce the operational costs associated with managing cryptography, and meaningfully lower long‑term security risk."

What about quantum companies themselves? After all, aren't they causing the problem in the first place? As de Jong says, the supply chain is already seeing a lot of countermeasures embedded into products by design, for example, quantum-safe features in the systems that cloud companies provide.

Pro bono support may also be available to smaller companies without the budgets or expertise to fight this battle. But, he says, the problem is likely to impact the larger companies the most.

To adequately prepare, the experts also recommend that building quantum literacy among technical teams and executives is essential. These teams should then devise roadmaps, with budgets over the coming years incorporating more quantum line items.

This transition is new to almost everyone, meaning that it's a journey of discovery and the best practice is still being formulated. There are, however, companies that are further along the journey than others – and organizations should liaise with one another so that everyone can benefit together.

"The transition to quantum-safe is new for almost everyone," de Jong adds, "so I would advise enterprise CXOs not to try and reinvent the wheel themselves, but rather work with companies that have been working on it for several years, so everyone can benefit from the collective knowledge."

The timelines are shrinking with each quantum computing breakthrough, and there's a general acceptance among experts that it won't be possible for businesses to be fully quantum-ready by 2029 – especially if you factor in the HNDL attacks that have already happened.

That said, it's never too late to act to avoid the very worst of it, and businesses should do what they can to get as far ahead of this threat as possible before it's too late – no matter how tempting it is to route budgets into more appealing areas like AI.

Should more businesses begin to act faster, when 'Q-Day' begins to take hold, there's still every chance, much like the Y2K bug, that this will become yet another amusing anecdote from the annals of tech history about a massive computing threat that was avoided.

Keumars Afifi-Sabet is a writer and editor that specialises in public sector, cyber security, and cloud computing. He first joined ITPro as a staff writer in April 2018 and eventually became its Features Editor. Although a regular contributor to other tech sites in the past, these days you will find Keumars on LiveScience, where he runs its Technology section.