Quantum Computing is a Silent Threat too Many Companies are Ignoring
Quantum computing has long been the subject of both fascination and fear. With the potential to revolutionise entire industries, it’s poised to disrupt current encryption standards and upend how we protect data. Yet despite this looming reality, most organisations appear to be standing still. According to ISACA’s inaugural Quantum Computing Pulse Poll, a staggering 95% of organisations have no roadmap in place for quantum readiness.
That’s despite the fact that nearly two-thirds (62%) of technology and cybersecurity professionals admit they’re worried quantum will break current internet encryption standards. Even more sobering is that only 5% consider quantum a high priority for near-term planning.
“Many organisations underestimate the rapid advancement of quantum computing and its potential to break existing encryption” said Jamie Norton, ISACA board director. “They need to start examining whether they have the expertise to implement post-quantum cryptography solutions now, to ensure they are able to effectively mitigate its impacts.”
Innovation Meets Risk
Quantum computing holds the promise of dramatic breakthroughs. Forty-eight percent of professionals surveyed are optimistic about quantum’s role in their industries, while 63% believe it will speed up data analysis and computational tasks significantly. Almost half (46%) anticipate that quantum will usher in revolutionary innovations.
But there’s a flip side to this coin. Quantum’s potential to outpace classical systems also brings substantial risk. Sixty-three percent of those surveyed say they expect quantum to either increase or shift cybersecurity threats. Meanwhile, 57% foresee a rise in overall business risk.
Perhaps most alarming: 62% are concerned that quantum computing will compromise today’s encryption protocols before industries can implement the new post-quantum algorithms currently being developed by the US National Institute of Standards and Technology (NIST). A further 56% warn of a growing trend among cybercriminals to “harvest now, decrypt later”—a tactic where bad actors stockpile encrypted data today, with the intention of cracking it once quantum computing becomes a practical tool.
A Lack of Awareness
Despite these grave concerns, the pace of organisational response remains sluggish. Forty percent of professionals surveyed say they’re unaware of their company’s current approach to quantum, while another 41% admit their organisation has no plans to tackle it anytime soon.
This inertia is especially puzzling when you consider that one in four respondents believes quantum computing will hit the mainstream within five years. An additional 39% see that happening within the next decade. And yet:
- Just 5% say quantum is a current high priority
- 15% include it on a long-term roadmap but not in the short-term
- 19% have only discussed it informally
- 37% haven’t discussed it at all
- 24% simply don’t know
In other words, most organisations are flying blind.
Few Understand the Standards That Could Save Them
Even with NIST working on quantum-safe cryptographic standards for more than a decade, awareness remains dismal. Only 7% of those surveyed claim a solid understanding of these standards, while 44% confess they’ve never even heard of them.
Given how long these standards have been in development, this lack of awareness is a red flag. As the global race toward quantum accelerates, businesses can’t afford to ignore these guidelines. They will be the cornerstone of secure systems in a post-quantum world.
Educating the Workforce
Upskilling and awareness-building within the tech sector are crucial. Yet ISACA’s findings paint a bleak picture: over half (55%) of enterprises haven’t started preparing at all. Worse still, 30% of IT and cybersecurity professionals admit they don’t fully understand quantum’s capabilities.
This highlights a dangerous skills gap. Without a trained workforce, organisations will be ill-equipped to navigate the complex challenges that quantum introduces. “Start by 1) identifying where encrypted data are stored and devices that use encryption, 2) developing a plan to transition to post-quantum cryptography prioritising critical data and systems, and 3) continuously monitoring for updated software and firmware with post-quantum cryptography” advises Rob Clyde, chairman at Crypto Quantique and former ISACA board chair.
“Waiting until quantum computing is here is too late, especially given today’s harvest-now, decrypt-later threat,” he adds.
The Case for Immediate Action
Quantum computing isn’t just a future concern—it’s a present imperative. With quantum processors improving at a rapid pace and national security agencies already making moves to future-proof critical systems, businesses in every sector need to take heed.
According to experts, here’s what organisations should prioritise:
- Assess Data Sensitivity: Identify encrypted information that, if exposed in the future, could cause long-term damage.
- Monitor Emerging Standards: Stay up-to-date with NIST’s post-quantum cryptography initiatives.
- Develop a Transition Plan: Start mapping a phased migration to quantum-safe encryption.
- Invest in Talent: Begin training internal teams or hiring experts in quantum security.
- Engage Leadership: Ensure that boards and executives understand the urgency and strategic importance.
ISACA’s Role in the Quantum Readiness Journey
With a global network of over 185,000 members and 230 local chapters in 190 countries, ISACA is uniquely positioned to lead the charge in quantum preparedness. Through its resources, training programmes, and advocacy, ISACA continues to empower digital trust professionals to stay ahead of the curve.
The organisation also leverages its Foundation arm to foster career pathways in emerging tech fields, including quantum computing.
Getting Ahead of the Curve
The message is loud and clear: ignoring quantum is no longer an option. While the technology promises immense rewards, the risks of inaction are equally immense. With encryption vulnerabilities, data breaches, and cyber threats on the line, the time to prepare is now—not when quantum is already knocking at the door.
It’s a tough pill to swallow, but those that act early will gain a vital edge. And in today’s volatile digital landscape, that edge could mean the difference between thriving and surviving.
