Organizations can no longer ignore the rapid advance of quantum technology, how it works, and how dramatically it will reshape cybersecurity. As this technology evolves, it becomes essential to prepare for the challenges it will inevitably introduce.
Introduction
Quantum technology represents a historic turning point: by leveraging the principles of quantum mechanics, it enables data processing and problem-solving at speeds and complexity levels that traditional computers can never reach. Its computational power is expected to grow rapidly, calling into question the foundations of modern cybersecurity, making today’s cryptographic systems vulnerable, and forcing organizations to rethink their digital security strategies for the coming decades.
What Is Quantum Computing?
Quantum computers, unlike traditional systems that rely on bits (0 or 1), use qubits (quantum bits), which can exist in multiple states simultaneously thanks to the principle of quantum superposition. While a classical computer must test each possible solution sequentially, a quantum computer can evaluate many potential solutions in parallel, making it exceptionally effective at solving complex mathematical problems—including those that underpin today’s cryptography.
The Threat: Vulnerability of Current Cryptographic Algorithms
The computational power of quantum computing threatens the very foundations of today’s cybersecurity by weakening the cryptographic systems we rely on. In particular, the most widely used algorithms today are vulnerable to quantum attacks:
RSA
One of the most common asymmetric cryptographic algorithms, used to secure online communications, digital signatures, and SSL/TLS certificates. Its security depends on the difficulty of factoring the product of two large prime numbers. For example, factoring a 2048-bit number (about 617 digits) would take classical computers billions of years, but a quantum computer using Shor’s algorithm could break it in a relatively short time.
ECC (Elliptic Curve Cryptography)
ECC uses the mathematical properties of elliptic curves to generate shorter keys that still provide strong security. It is widely used in mobile devices, cryptocurrencies like Bitcoin and Ethereum, and secure communications. However, its core mathematical problem-elliptic curve discrete logarithms-is also vulnerable to quantum algorithms.
As Valerio Pastore, CTO of CyberGrant, explains:
“When a quantum computer capable of breaking today’s cryptography becomes a reality, conventional cryptography will essentially be rendered obsolete, exposing everything we rely on today for communications and data security.”
Pastore uses a powerful analogy:
“Imagine having the best safe door on the market. It works perfectly-nobody can get in. But ten years from now, a new technology will let anyone open that door in seconds. The problem? Thieves are already making copies of your keys today, just waiting to get that technology.”
Two Concrete Threat Scenarios
Today, two scenarios are especially concerning:
1. Harvest Now, Decrypt Later
Adversaries collect and store encrypted data now, intending to decrypt it once a cryptographically relevant quantum computer becomes available. Government records, highly sensitive personal data, and long-term confidential business information are particularly at risk.
2. Long Migration Windows
For complex systems like PKI infrastructures, transitioning to quantum-safe cryptography may take years, raising the risk that organizations will not migrate in time to avoid exposure.
How Much Time Do We Have?
According to the Global Risk Institute’s 2024 Quantum Threat Timeline Report, experts estimate that within 5 to 15 years, a CRQC (Cryptographically Relevant Quantum Computer) could break today’s standard cryptography in under 24 hours. Many experts see 2025 as the final opportunity to begin transitioning to post-quantum cryptography before the risk becomes critical.
Areas of Critical Impact
Quantum computing has the potential to compromise virtually every aspect of modern digital security:
• Secure communications (TLS/SSL)
• Digital identities and authentication
• Financial transactions
• Sensitive data (health, government, corporate)
• Blockchain and cryptocurrencies
Who Is Not Prepared (and Who Is Most at Risk)
Despite the urgency, most organizations have not taken meaningful steps:
• 95% of organizations have no quantum computing roadmap
• Only 5% consider quantum readiness a top priority
Experts warn that 2025 may be the last realistic window to begin migrating before CRQCs put everyone at risk.
According to Pastore:
“Right now, only banks, insurers, hospitals, healthcare systems, governments, and critical energy and communications infrastructure are starting to prepare… And small businesses-convinced no one wants their data-are actually the most exposed.”
Awareness in Italian/EU Companies vs. the Quantum Threat
Fabrizio Fantini, Chief Quantum Officer of the QUANTUM AGENCY working group, highlights how quantum literacy in Italy remains low due to limited and uneven awareness.
Fantini explains:
“Many micro-enterprises of Made in Italy are still at the early stage: they know the problem exists, but have not adopted concrete strategies, risking exclusion from the fourth industrial revolution.”
Across Europe, while some large infrastructure providers are preparing, most SMEs remain stuck in the evaluation or planning phase. Recent industry data shows that nearly half of organizations are not ready to face the quantum threat.
Fantini warns:
“Without collaborative learning processes, we risk finding ourselves unprepared when Quantum Day arrives.”
For this reason, QUANTUM AGENCY launched QDAY, scheduled for December 31, 2025 – the first annual virtual event dedicated to preventing Quantum Day through sustainable and regenerative projects for the Italian Quantum System. (https://quantum2025.org/iyq-event/qday-italia/).
Fantini also stresses the importance of continuous training and strong governance:
“It is essential to prepare security teams, CIOs, CTOs, and corporate boards through real risk awareness and informed technological choices, integrating the topic into risk registers and ESG/business continuity plans. The transition to PQC is not just about the resilience of individual companies, but entire ecosystems.”
The Solution: Post-Quantum Cryptography
In 2024, NIST officially released the first standardized quantum-resistant algorithms:
- FIPS 203 (ML-KEM) – Primary standard for general encryption
- FIPS 204 (ML-DSA) – Primary standard for digital signatures
- FIPS 205 (SLH-DSA) – Backup standard for digital signatures
A fundamental concept for organizations is crypto-agility: the ability to quickly adapt systems to new cryptographic mechanisms using automation to simplify and accelerate migration.
The Hybrid Approach: Dual Protection
The most practical solution is a hybrid approach that combines traditional and post-quantum cryptography.
As Pastore explains:
“In our secure file-sharing sector, this model delivers dual protection: the current standard, which is highly secure today, plus the new quantum-resistant standard. It’s like having two locks on the same door: if one breaks, the other holds.”
For example, when an employee sends a confidential document via FileGrant, it is protected by an RSA lock (secure today) and a CRYSTALS-Kyber lock (quantum-resistant). Both must be broken to access the file.
Even if quantum computers break RSA in ten years, the second lock will still hold.
How to Prepare: 5 Essential Strategies
Pastore outlines a structured approach:
- Cryptographic Inventory – Identify where and how cryptography is used.
- Risk Assessment – Identify long-term-value data vulnerable to HNDL attacks.
- Hybrid Approach – Combine RSA/ECC with PQC; test NIST algorithms.
- Stakeholder Engagement – Ensure partners and vendors have quantum roadmaps.
- NIST Standards Implementation – Gradually adopt the three newly standardized algorithms.
Pastore concludes:
“You don’t need to do everything tomorrow morning. But starting today means avoiding panic when it’s too late.”
The Cost of Inaction vs. Transition
The U.S. Office of Management and Budget estimates that the federal transition to PQC will cost $7.1 billion between 2025 and 2035.
Yet, the cost of inaction may be catastrophic, with long migration periods leaving organizations exposed.
The European Commission has also published a roadmap requiring all EU member states to define and launch national post-quantum strategies by the end of 2025.
Conclusion
Security professionals emphasize that preparing for the quantum future is not just a technological challenge but a strategic one requiring leadership, investment, and long-term vision.
Post-quantum technologies exist, NIST standards are published, roadmaps are available.
What’s missing is urgency.
The quantum future is not a matter of if, but when.
Organizations that fail to invest now may be exposed at the most critical moment, when reaction time is gone.
Quantum Day may seem distant-but in cybersecurity terms, it is right around the corner.
The combination of quantum computing and AI-driven threats could overwhelm unprepared systems, especially in critical infrastructure.
The real question for every CISO is no longer “Should we prepare?” but
“How fast can we start?”
.svg){kind=icon}
