Only half of organizations across North America and Europe are geared up for looming quantum cybersecurity threats, with some even thinking dangers are being exaggerated.
A new survey from Keyfactor revealed that nearly half (48%) aren't ready for the challenges posed by quantum computing, which will render public-key cryptography obsolete. Mid-sized organizations appeared particularly vulnerable, with 56% saying they weren't prepared.
While 42% of cybersecurity leaders said they were actively addressing quantum risk, 33% plan to respond when the risks are more immediate, 24% are waiting to see what actions other companies take, and 2% have no plans to address risks at all.
It's all about perception, however. Companies that view post-quantum cryptography (PQC) as a significant undertaking were more than twice as likely to be taking steps now, with 49% doing so, compared with just 24% of those that consider the risks to be minor or overstated.
“Cryptography is the critical infrastructure of our digital world — it’s what keeps data, systems, and trust intact. But that infrastructure is under threat. Cryptographically relevant quantum computers are coming, and when they do, today’s encryption will break,” said Jordan Rackie, CEO of Keyfactor.
“Our research shows that while awareness is growing, action is lagging,” Rickie added. “Organizations that treat PQC as a strategic priority today will be the ones who lead tomorrow — in security, resilience, and digital trust.”
Quantum cybersecurity threats are on the radar for some
Notably, at nearly half (46%) of companies, cybersecurity teams are leading the charge on championing PQC preparedness, followed by the C-suite at 33%, and board members at 22%.
The main driver for action is, unsurprisingly, cybersecurity, cited by 54%. However, half cited enhanced customer trust, 49% reduced cyber insurance premiums, and 48% a competitive edge.
The challenges, meanwhile, are being exacerbated by a lack of skilled personnel, limited time, and competing priorities, both cited by four-in-ten, with unclear industry standards just behind at 39%.
“Post-quantum cryptography is a once-in-a-generation opportunity to rebuild the foundation of digital trust,” said Chris Hickman, CSO at Keyfactor.
“It will require a full-scale transformation in how we protect every encrypted interaction, file, and transaction – past, present, and future. This transition is about showing leadership, driving innovation, and building a security posture that can stand the test of time.”
Earlier this year, the UK's National Cyber Security Centre (NCSC) published a timeline it said organizations should follow to prepare themselves for quantum threats.
Aimed mainly at large organizations, it warned they should have identified which cryptographic services need upgrades and created a migration plan by 2028.
Similarly, the cybersecurity agency urged enterprises to carry out high-priority upgrades by 2031, refining their plans as PQC evolves. Meanwhile, by 2035 they should have migrated completely to PQC for all systems, services, and products.
Make sure to follow ITPro on Google News to keep tabs on all our latest news, analysis, and reviews.
MORE FROM ITPRO
- RSAC in focus: Quantum computing and security
- The quantum computing sector needs to cut the hype and focus on responsible development
- Preparing for the quantum computing revolution
-
What businesses need to know about the General-Purpose AI Code of PracticeNews General-purpose AI model providers will face heightened scrutiny
-
Windows 10: Six essential steps IT teams should take over the next two monthsIndustry Insights With Windows 10 support ending soon, IT leaders must act now to mitigate risk
-
The Scattered Spider ransomware group is infiltrating Slack and Microsoft Teams to target vulnerable employeesNews The group is using new ransomware variants and new social engineering techniques - including sneaking into corporate teleconferences
-
UK cybersecurity workers are overworked, overwhelmed, and burning out faster than global counterparts — here's whyNews Gaps in visibility, poor board communication, and a lack of cyber maturity are leading to high levels of burnout
-
Global cybersecurity spending is going to hit $213 billion in 2025 — here's what’s driving investmentNews Spending across major fronts comes in the wake of rising cloud security threats and growing skills gaps
-
A flaw in Google’s new Gemini CLI tool could’ve allowed hackers to exfiltrate dataNews The company has moved to fix a vulnerability that allowed the execution of malicious code
-
Hackers breached a 158 year old company by guessing an employee password – experts say it’s a ‘pertinent reminder’ of the devastating impact of cyber crimeNews A Panorama documentary exposed hackers' techniques and talked to the teams trying to tackle them
-
Everything we know about the Allianz Life data breach so farNews The company has confirmed in a filing that data was accessed earlier this month
-
ExpressVPN updates Windows app to fix vulnerabilityNews The flaw was reported through ExpressVPN's bug bounty program
-
NCSC says ‘limited number’ of UK firms affected by SharePoint attack as global impact spreadsNews The SharePoint flaw has already had a wide impact according to reports from government security agencies
