In the boardroom the question always arrives in the same shape: when does the quantum computer get here. It is the wrong question, and it produces delay. The right one comes from whoever owns the architecture: how many years must the data we handle today stay unreadable to anyone not authorized to see it.
The Clusit Report 03-2026 places the obsolescence horizon for current encryption and signature algorithms somewhere between 2030 and 2035, and notes that the risk already weighs on organizations today, with no operational quantum computer required, because an adversary can start accumulating encrypted data now and decrypt it once the technology matures. Anyone signing a ten-year supply contract, holding a KYC file or filing a patent is already producing data that crosses that horizon end to end.
Quantum-safe encryption, also called post-quantum cryptography, is the set of algorithms designed to stay secure against a sufficiently powerful quantum computer. This is not research material, it is standards material. In August 2024, after years of public evaluation, NIST finalized the first three. FIPS 203 specifies ML-KEM, a key encapsulation mechanism derived from the CRYSTALS-Kyber algorithm and intended to replace key exchange schemes such as RSA and Diffie-Hellman. FIPS 204 and FIPS 205 cover digital signatures, with ML-DSA (from CRYSTALS-Dilithium) and SLH-DSA (from SPHINCS+). Their security rests on mathematical problems, lattice problems among them, believed to be hard even for a quantum machine.
One point of terminology, because it matters in an RFP. Quantum-safe and post-quantum describe expected resistance based on current knowledge, not a permanent guarantee. A vendor writing “quantum-proof” on a datasheet is promising a certainty the mathematics has not issued. ENISA recommends a hybrid approach where feasible, pairing classical and post-quantum algorithms so that no single scheme carries the whole load while the new primitives are tested in the field. On the application side, file sharing is the first workload the transition reaches, and we covered it in detail in the 2026 guide to post-quantum encrypted file sharing.
The mechanism is simple and it changes the risk calculation. An attacker copies encrypted traffic, sets aside backup volumes, keeps a database dump they cannot read today. They do not need the key now. They only need reasonable confidence that within a few years a machine will exist that breaks the public-key algorithms most of today’s infrastructure rests on.
The consequence is counterintuitive. Data that must stay confidential for six months carries almost no quantum risk: by the time decryption becomes feasible, it no longer matters. Data that must stay confidential for ten or twenty years sits in the opposite position, because the attacker can afford to wait while the value of the information stays intact.
There is also a difference of scale that boardrooms nearly always conflate. Breach lifecycle, the time between compromise and containment, is put at 241 days on average by IBM’s Cost of a Data Breach 2025, the lowest figure in nine years; breaches running past 200 days remain the most expensive, averaging USD 5.01 million against a global average cost of USD 4.44 million. Those numbers measure how fast defenses react. The lifecycle of the data is measured in years instead, and an archive exfiltrated today and decrypted in 2032 has no incident closure date: the compromise surfaces when every perimeter countermeasure stopped being relevant long ago.
Further reading: Beyond the perimeter: file-centric DLP
Inventory comes before algorithm choice. It is also the first thing European guidance asks for, and in practice the only step that lets you put a credible number on cost and timeline.
A useful cryptographic assessment answers four questions, in this order:
The output is a dependency map across applications, products, platforms and cryptographic operations, plus the formal entry of the quantum threat into the risk register. Without that base, any migration plan is an educated guess.
The transition is not run everywhere at once. The order comes from two variables: how long the data must stay confidential, and how damaging its exposure would be. The European roadmap offers a working threshold: treat as high risk any data that must remain confidential for at least ten years, and any product with an expected life beyond 2030.
Through that lens the priority list stays stable across sectors:
The subject left the technical perimeter and entered the regulatory one, with dates attached. Recommendation (EU) 2024/1101 of 11 April 2024 established a roadmap for the coordinated implementation of the transition to post-quantum cryptography, later detailed by the NIS Cooperation Group in the EU roadmap for the PQC transition. There are three milestones. By the end of 2026 every Member State should have started the transition, beginning with inventory and awareness. By the end of 2030 high-risk use cases and critical infrastructure must be secured, with the explicit note that vulnerable public-key mechanisms should no longer be used on their own past that date. By the end of 2035 the transition should extend to medium-risk cases and be completed for as many systems as possible.
Horizontal regulation pushes the same way without naming a specific technology. Article 32 of the GDPR requires measures appropriate to “the state of the art” and names encryption explicitly: as post-quantum algorithms become the state of the art, the threshold of what counts as adequate moves. In financial services, Article 9 of Regulation (EU) 2022/2554 (DORA) and its technical standards require cryptographic controls calibrated to data classification and risk. Directive (EU) 2022/2555 (NIS2), transposed in Italy through Legislative Decree 138/2024, lists policies on the use of cryptography among the minimum risk management measures in Article 21.
Further reading: Post-quantum security: EU Member State obligations and PQC · NIS2 deadline October 31, 2026
This is where you decide whether the 2030 migration will be a project or an update. If encryption is a property of the channel or the environment, replacing an algorithm means revisiting every application, every integration, every flow. If it is a property of the data, centrally managed, replacement becomes a platform operation.
There is a second, more immediate effect. A file encrypted in transit becomes readable again as soon as the channel is decrypted at the far end. An archive protected at rest loses every defense the moment it is copied elsewhere, and that copy is exactly what a harvest now, decrypt later attack is after. It is the same mechanism visible in the Booking, Eataly and Trenitalia breaches: the data was protected only while it stayed where it was supposed to be.
Protection that holds over time is protection that belongs to the data and travels with it. If a document stays encrypted outside the perimeter, theft hands the attacker unusable bytes, today and in 2032 alike.
FileGrant, the file-centric platform by CyberGrant, encrypts every document at creation using quantum-safe algorithms based on CRYSTALS-Kyber (NIST FIPS 203) and keeps that protection attached to the file for its entire lifecycle, inside and outside the corporate network. This is the model we call file-centric DLP, and for a CIO the architectural consequence is this: encryption stops being a property of each application and becomes a platform service, with zero-knowledge keys, audit trail and access revocation that stay in force after the file has been shared with a supplier or a consultant. On-premise deployment keeps keys and data under direct control, which is usually the opening requirement in any data sovereignty specification.
For documents already living in Microsoft 365, CyberGrant Connector is the extension that brings the same quantum-safe encryption inside SharePoint and OneDrive with no migration: files stay where they are, users keep their Microsoft login and habits, and encryption also covers the non-Office formats Microsoft Purview leaves uncovered. Connector sits alongside the Microsoft stack, it does not replace it.
Further reading: How to encrypt SharePoint files without replacing it or migrating
Five steps, in the order worth budgeting them.
The 2030-2035 horizon is not a calendar deadline. It is the moment organizations find out what was copied in the years before.
Quantum-safe encryption, also called post-quantum cryptography, is the set of algorithms designed to stay secure against a quantum computer. NIST finalized the first standards in August 2024: FIPS 203 (ML-KEM, derived from CRYSTALS-Kyber) for key exchange, FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) for digital signatures. The term describes expected resistance based on current knowledge, not an absolute guarantee.
Post-quantum cryptography uses classical algorithms that run on ordinary hardware, built on mathematical problems believed to be hard even for a quantum computer: this is the path NIST standardized with FIPS 203, 204 and 205. Quantum cryptography, such as quantum key distribution, requires dedicated hardware and optical infrastructure. For an enterprise migration planned over twelve to twenty-four months, the practicable reference is post-quantum cryptography.
It is an inventory of an organization’s cryptographic operations, combined with a dependency map across applications, platforms, vendors and protected data. It starts by identifying where encryption and signing happen, with which algorithms, on which data, and for how many years that data must stay confidential, including third-party libraries, firmware and the supply chain. It is the precondition for any post-quantum migration plan and the first action European guidance asks organizations to complete.
Migrate first the data that must stay confidential for at least ten years: intellectual property and trade secrets, clinical and health records, long-term contracts and legal documentation, KYC and anti-money-laundering files, and long-lived credentials and keys. The European roadmap uses exactly that ten-year confidentiality threshold, together with products whose expected life runs past 2030, to define high-risk cases.
Recommendation (EU) 2024/1101 and the NIS Cooperation Group roadmap set three milestones: start the transition by the end of 2026, secure high-risk use cases by the end of 2030, extend to medium-risk cases and complete for as many systems as possible by the end of 2035. After 2030, vulnerable public-key mechanisms should no longer be used on their own.
Cryptographic agility is the ability to replace an algorithm without redesigning the applications that use it. It matters because the post-quantum transition is not a single step: the standards will keep evolving. If encryption is a property of the channel, every algorithm change touches every integration; if it is a property of the data, as in FileGrant, the file-centric platform by CyberGrant, replacement becomes a centralized platform operation.
CyberGrant Connector is the FileGrant extension that automatically encrypts documents inside SharePoint and OneDrive with no migration: files stay where they are, users keep their Microsoft login and habits, encryption is zero-knowledge and also covers the non-Office formats Microsoft Purview leaves uncovered. Connector sits alongside Microsoft 365, it does not replace it.