Only half of organizations across North America and Europe are geared up for looming quantum cybersecurity threats, with some even thinking dangers are being exaggerated.
A new survey from Keyfactor revealed that nearly half (48%) aren't ready for the challenges posed by quantum computing, which will render public-key cryptography obsolete. Mid-sized organizations appeared particularly vulnerable, with 56% saying they weren't prepared.
While 42% of cybersecurity leaders said they were actively addressing quantum risk, 33% plan to respond when the risks are more immediate, 24% are waiting to see what actions other companies take, and 2% have no plans to address risks at all.
It's all about perception, however. Companies that view post-quantum cryptography (PQC) as a significant undertaking were more than twice as likely to be taking steps now, with 49% doing so, compared with just 24% of those that consider the risks to be minor or overstated.
“Cryptography is the critical infrastructure of our digital world — it’s what keeps data, systems, and trust intact. But that infrastructure is under threat. Cryptographically relevant quantum computers are coming, and when they do, today’s encryption will break,” said Jordan Rackie, CEO of Keyfactor.
“Our research shows that while awareness is growing, action is lagging,” Rickie added. “Organizations that treat PQC as a strategic priority today will be the ones who lead tomorrow — in security, resilience, and digital trust.”
Quantum cybersecurity threats are on the radar for some
Notably, at nearly half (46%) of companies, cybersecurity teams are leading the charge on championing PQC preparedness, followed by the C-suite at 33%, and board members at 22%.
The main driver for action is, unsurprisingly, cybersecurity, cited by 54%. However, half cited enhanced customer trust, 49% reduced cyber insurance premiums, and 48% a competitive edge.
The challenges, meanwhile, are being exacerbated by a lack of skilled personnel, limited time, and competing priorities, both cited by four-in-ten, with unclear industry standards just behind at 39%.
“Post-quantum cryptography is a once-in-a-generation opportunity to rebuild the foundation of digital trust,” said Chris Hickman, CSO at Keyfactor.
“It will require a full-scale transformation in how we protect every encrypted interaction, file, and transaction – past, present, and future. This transition is about showing leadership, driving innovation, and building a security posture that can stand the test of time.”
Earlier this year, the UK's National Cyber Security Centre (NCSC) published a timeline it said organizations should follow to prepare themselves for quantum threats.
Aimed mainly at large organizations, it warned they should have identified which cryptographic services need upgrades and created a migration plan by 2028.
Similarly, the cybersecurity agency urged enterprises to carry out high-priority upgrades by 2031, refining their plans as PQC evolves. Meanwhile, by 2035 they should have migrated completely to PQC for all systems, services, and products.
Make sure to follow ITPro on Google News to keep tabs on all our latest news, analysis, and reviews.
MORE FROM ITPRO
- RSAC in focus: Quantum computing and security
- The quantum computing sector needs to cut the hype and focus on responsible development
- Preparing for the quantum computing revolution
-
Trump's AI executive order could leave US in a 'regulatory vacuum'News Citing a "patchwork of 50 different regulatory regimes" and "ideological bias", President Trump wants rules to be set at a federal level
-
TPUs: Google's home advantageITPro Podcast How does TPU v7 stack up against Nvidia's latest chips – and can Google scale AI using only its own supply?
-
LastPass hit with ICO fine after 2022 data breach exposed 1.6 million users – here’s how the incident unfoldedNews The impact of the LastPass breach was felt by customers as late as December 2024
-
Researchers claim Salt Typhoon masterminds learned their trade at Cisco Network AcademyNews The Salt Typhoon hacker group has targeted telecoms operators and US National Guard networks in recent years
-
Trend Micro issues warning over rise of 'vibe crime' as cyber criminals turn to agentic AI to automate attacksNews Trend Micro is warning of a boom in 'vibe crime' - the use of agentic AI to support fully-automated cyber criminal operations and accelerate attacks.
-
Cyber budget cuts are slowing down, but that doesn't mean there's light on the horizon for security teamsNews A new ISC2 survey indicates that both layoffs and budget cuts are on the decline
-
NCSC issues urgent warning over growing AI prompt injection risks – here’s what you need to knowNews Many organizations see prompt injection as just another version of SQL injection - but this is a mistake
-
Chinese hackers are using ‘stealthy and resilient’ Brickstorm malware to target VMware servers and hide in networks for months at a timeNews Organizations, particularly in the critical infrastructure, government services, and facilities and IT sectors, need to be wary of Brickstorm
-
AWS CISO Amy Herzog thinks AI agents will be a ‘boon’ for cyber professionals — and teams at Amazon are already seeing huge gainsNews AWS CISO Amy Herzog thinks AI agents will be a ‘boon’ for cyber professionals, and the company has already unlocked significant benefits from the technology internally.
-
The Scattered Lapsus$ Hunters group is targeting Zendesk customers – here’s what you need to knowNews The group appears to be infecting support and help-desk personnel with remote access trojans and other forms of malware
