How well prepared is your business for Q Day?
Somewhere, there is a data centre where an adversary may be storing your company’s encrypted customer data, records and intellectual property. They cannot yet read the data, but they are betting on the fact that one day they will be able to. That day already has a name. It is Q Day, the day when a quantum computer becomes powerful enough to break the cryptography that secures most of the digital world. For businesses, the difficult truth to face is that the deadline for action is not Q Day itself, it is far earlier.
Putting Q Day in context
Quantum computers will not make all classical cryptography redundant overnight. Algorithms already exist that, when operating on a sufficiently large fault-tolerant quantum computer, could theoretically break many of the schemes underpinning the worldwide web and other forms of digital security. Even that relies on a quantum computing system free of faults, currently still a major obstacle for the industry, albeit one attracting a great deal of intelligent attention. Symmetric encryption such as AES-256 and modern hash functions are likely to be far more resilient, although as quantum improves existing systems may ultimately all fall under its power.
Rumours have been circulating that Q Day could be as soon as the late 2020s or early 2030s. However, opinion is divided. Nevertheless, the timing is important: even the 2030s allow little time for businesses to grasp and act upon the implications of quantum technologies and the need for quantum-reslience.Â
What is quantum computing?
Put simply, it is an entirely new way of thinking about algorithms and computing, which is why classical encryption becomes vulnerable under its gaze. Essentially, quantum computing is a way of processing information that uses the rules of quantum physics rather than the classical logic embedded in today’s computers.Â
A classical computer stores information in bits or binary digits, each of which is either a 0 or a 1. A quantum computer uses qubits, which can exist as a blend of 0 and 1 at the same time, a property known as superposition. Until measured, a qubit is described by probabilities for each outcome rather than a single definitive value.
Quantum computers are not simply faster versions of classical computers. Because of their unique architecture they are expected to offer enormous advantages when dealing with certain challenges such as simulating molecules and materials, dealing with optimisation problems, factoring large numbers (which is why they are relevant to cryptography), and searching unstructured data more efficiently. For everyday tasks such as browsing, word processing, or gaming they offer no advantage; it’s not what they exist to do.
Technological challenges remain. Qubits are fragile. Heat, vibration, and electromagnetic noise can disturb them, causing errors to occur. Building machines with enough high-quality qubits and effective error correction to deal with large real-world problems remains elusive, but the race is on and it is fair to assume that global talent and ingenuity will not be frustrated forever. The fact that work remains to be done before quantum computing can fulfil its potential should not be an excuse for businesses to kick the quantum-resilience can down the digital road. Already, quantum computers are rented out through the cloud, usually on a pay-as-you-go or subscription basis. IBM placed a real quantum processor on the public cloud in 2016 and remains the largest provider of free and paid quantum access. Amazon Braket (AWS) is an aggregator rather than a hardware builder (although AWS has begun developing its own quantum chip), but it offers superconducting systems from Rigetti and Oxford Quantum Circuits, neutral-atom technology from QuEra, ion-trap systems from IonQ, and photonic devices from Xanadu. Microsoft Azure Quantum is also an aggregator, hosting hardware from partners such as Quantinuum, Atom Computing, IonQ, Rigetti, and Pasqal. For Google Quantum AI access is limited with the company claiming its Quantum Computing Service is restricted to an approved group. However, all this indicates one thing: quantum computing already exists, is already accessible, and its likely maturity is almost certainly not far away in relative terms.
HNDL – Harvest Now, Decrypt Later
One of the most compelling reasons for businesses to take action today is the HNDL phenomenon. Certain data encrypted to today’s standards that has been intercepted or stolen can be stored cheaply and potentially decrypted once quantum capability arrives. Having said that, large-scale data thefts are not necessarily proof of quantum-anticipatory hoarding – there are many other reasons for scraping data including criminal intention and individual challenge. Nevertheless, intelligence agencies are widely aware of the potential threat and logic dictates that any data stolen or harvested today that must remain confidential for ten, twenty, thirty or more years, such as health records, legal files, trade secrets, financial histories, and identity data, could already be at risk.
Mosca’s inequality says that if the time an organisation’s data must stay secret, plus the time it takes that company to migrate to quantum-safe cryptography, exceeds the time until Q Day, for that business it is already too late. That may be true for historic data but for data companies want to collect and will collect moving forward, the time for action is now. Any organisation holding or continuing to collect long-term sensitive data and facing a migration that might take several years should already be alive to threats from quantum computing and the need for quantum-resilience.
Why isn’t Q Day all over mainstream media?
It does not help that Q Day itself is not a fixed point and, with technical issues still to be resolved, is more likely to be an introduction period rather than a day. Since NIST (the National Institute of Standards and Technology) finalised its first post-quantum standards in 2024, there has been some media coverage, especially in technology media, security trade channels and some national outlets. However, it could be argued that media coverage remains remarkably low compared to the risks quantum computing potentially represents.
Why isn’t Q Day all over mainstream media? It does not help that Q Day itself is not a fixed point and, with technical issues still to be resolved, is more likely to be an introduction period rather than a day. Since NIST (the National Institute of Standards and Technology) finalised its first post-quantum standards in 2024, there has been some media coverage, especially in technology media, security trade channels and some national outlets. However, it could be argued that media coverage remains remarkably low compared to the risks quantum computing potentially represents.
The risk is not perceived as being immediate
News tends to be built on things happening now. Q Day has no specific date and there is as yet no reportable breach that can be directly attributed to it. Gradual risks tend to be under-reported until they become crises.
The risk is difficult to explain
Quantum mechanics and public-key infrastructure (cryptography) are difficult subjects for a general audience. Media channels may fear that explaining the issues might simply be too challenging for their audiences. As a result, they may simply default to hype around quantum computers being allegedly impossible to hack, or vague doomsday scenarios.Â
Time-induced scepticism
Quantum has been five years away for decades. Journalists have seen overenthusiastic vendor claims that have most likely caused media channels to be wary of genuine risk versus exaggeration.
Where the real news exists
The organisations that probably comprehend the quantum risk best might include intelligence agencies and standards bodies, both of which tend to communicate in technical advisory rather than headline pieces.
There is a perceived absence of victims
Although we have seen reports of data being stolen on an international scale these reports are not always connected by media channels to quantum computing’s ability to future-decipher content. Without an identified harm, there is little for a media channel to write about. The irony is that by the time there’s a story the harm will already have been done.
The battle for attention
AI is absorbing enormous levels of media attention, and cyber coverage is dominated by ransomware, which is immediate and visible, potentially leaving little room for debates around the potential threats of quantum computing.Â
SMEs should beware
Large enterprises and governments tend to benefit from sizeable security teams, significant budgets and typically fall under regulatory pressure. Conversely, for SMEs, some or all of these are typically absent. Many are still struggling with multi-factor authentication, patching, and backups, and often lack a formal inventory of the cryptography they use, let alone where it resides. A large number are likely to rely on third-party software, cloud providers and managed services, which means their quantum-resilience is largely determined by suppliers over which they have little control and, in some cases, where there is little by way of transparency.Â
That dependency could be both a risk and an opportunity. By asking the right questions of vendors they should be able to make sensible procurement choices. For most of them, PQC (post-quantum cryptography) migration will take place through software updates and cloud platform changes, provided they are diligent and are not operating unsupported legacy systems.Â
What companies should be doing today
Sadly, the hype around the Y2K computer threat, which posited that programs storing year dates with only the final two digits, could lead to potential system failures, but didn’t, has left a legacy of distrust in similar-sounding predictions. Q Day is of a very different order. We already know some of the capabilities of quantum computing, especially with regards to cybersecurity, and many agencies are already making preparations. For that reason alone, companies should not be viewing the advent of quantum computing as something to be dealt with sometime in the future.Â
There are a number of sensible precautions every business should consider taking straight away:
Assign ownership:
determine who in the business should be made accountable for Q Day preparations. In a large company that should be at board level, and in a smaller company at owner or senior manager level. Without ownership, the concerns remain abstract.
Build a cryptographic inventory for the business:
it is not possible to migrate things that cannot be seen. It is critical that businesses identify where public-key cryptography is used such as websites, VPNs, email, databases, APIs, devices, payment systems, and supplier connections. The process begins with an audit of key systems and suppliers.
Classify all data by its shelf-life:
focus on the data that would still cause harm if exposed in 10, 20 or 30 years’ time. Prioritise protecting that data first because it is a natural harvest-now-decrypt-later target.
Question suppliers:
it is important to interrogate technology suppliers such as cloud, software and managed service providers regarding their PQC plans. Quantum-readiness questions should be included in procurement tenders and contract renewals. Businesses should avoid making commitments to vendors with no, or vague, PQC answers.
Interrogate the wider supply chain:
businesses must remember that their biggest vulnerability may lie somewhere in their supply chain. It is important to discuss PQC readiness and quantum-resilience with companies supplying goods, materials and services, especially critical ones.
Acquire crypto-agility:
the critical point here is the ability to change cryptographic algorithms without the need to rebuild systems. For example, avoid hard-coding algorithms, and seek platforms that can update centrally.
Follow standards rather than hype:
NIST has published standards including ML-KEM for key establishment and ML-DSA and SLH-DSA for signatures. Guidance for UK organisations can be found through the National Cyber Security Centre, including a migration timeline. It is important to be wary of vendors selling proprietary quantum-proof products outside these standards which, even of themselves can only be believed resistant. Many businesses will have horror stories of wasted expenditure in the run up to Y2K.
Start with the basics:
It is not just good PQC practice, but also good business practice, to ensure good key management, patching, network segmentation, and data minimisation. Data that is not held cannot be harvested. Policies around data retention can be a free quantum defence.
Plan and budget:
PQC should be treated as a multi-year programme rather than a project. By including it in existing technology review cycles the costs can be contained. As quantum computing advances, and quantum-based threats grow, it is also almost certain that initial work will need to be regularly updated to achieve true quantum-reslience.
Be informed and stay informed:
boards should be briefed as well as insurers, key customers and suppliers. Regulators and cyber insurers might start to ask questions if they are not doing so already, and early readiness could not only ease the transition but also potentially offer commercial advantage.
Perhaps unsurprisingly, MHA and Baker Tilly Ireland has already developed a series of tools to help its clients remain quantum-resilient. Our Risk, Resilience and Security team takes organisations from an unknown cryptographic risk position to a governed, prioritised, action-oriented roadmap for a migration plan to quantum-resilience, in five phases:
- Discovery and inventory
- Risk assessment
- Governance and Roadmap
- Long-life data controls
- Ongoing monitoring
These five stages cover the ten points mentioned and more, ensuring clients’ Q Day may be viewed as a name rather than a catastrophe.Â
The danger of Q Day is not that it is likely to arrive as a single event, but that its tendrils may have already been reaching out to data captured years previously. Media silence is likely to be indicative of the sector’s own structural considerations, such as the need for an event to deliver content, rather than the absence of an important issue. Business response needs to be calm and measured: knowing the data held and the vulnerabilities, being clear about existing protections, asking suppliers difficult questions, and building the ability to change. In the same way that Q Day is likely to arrive slowly, deliberately, systematically and over a period of time, so too should the business response to it be. Companies that take timely action today are likely to be the ones that avoid becoming the PQC headlines of the future.
Related content
