Industry · Active Deployment
Quantum Computing for Cybersecurity
Both a long-term threat (to current encryption) and a source of new tools (quantum key distribution) — the most mature quantum application from a deployment standpoint.
Maturity
Active deployment of post-quantum cryptography
Core threat
Shor's algorithm against RSA, Diffie-Hellman, and elliptic-curve cryptography
Standards
NIST FIPS 203 (ML-KEM), 204 (ML-DSA), and 205 (SLH-DSA), published August 2024
Backup standard
HQC selected by NIST in March 2025 as an additional key-encapsulation method
Not threatened much
Symmetric encryption such as AES-256 and hash functions
Key deadlines
Government timelines target migration of most systems between about 2030 and 2035
Overview
Cybersecurity is the one industry where quantum computing already demands action, even though no machine can yet break today's encryption. The reason is that a large, fault-tolerant quantum computer would run Shor's algorithm, which breaks the public-key cryptography that protects web traffic, software updates, digital signatures, and cryptocurrencies. Data encrypted today can be recorded and decrypted years later, so information that must stay secret for decades is already exposed in principle.
The response has two parts. The main one is post-quantum cryptography: new algorithms that run on ordinary computers and are believed to resist quantum attacks. The second is quantum technology used for security, including quantum key distribution and quantum random number generators. Governments have published standards and deadlines, and migration is under way in browsers, messaging apps, and cloud services.
Why this industry is a candidate for quantum computing
Public-key cryptography rests on mathematical problems, such as factoring and discrete logarithms, that are hard for classical computers but easy for Shor's algorithm. A 2025 analysis by Craig Gidney estimated that RSA-2048 could be factored by a machine with fewer than one million noisy physical qubits in under a week, a major drop from earlier estimates of tens of millions. Such machines do not exist today, but the estimate keeps falling.
Security planners think in terms of time. If information must stay confidential for X years, the migration takes Y years, and a quantum computer might appear in Z years, then trouble begins when X plus Y exceeds Z. Because migrations take a decade for large organizations, the planning has to start well before the machine exists.
Key facts and numbers
| Item | Detail |
|---|---|
| Standards published | FIPS 203 (ML-KEM), 204 (ML-DSA), and 205 (SLH-DSA) on August 13, 2024; HQC selected in March 2025 |
| UK NCSC milestones | Discovery and planning by 2028, priority migration by 2031, completion by 2035 |
| RSA-2048 break estimate | Under one million noisy physical qubits and under a week (Gidney, 2025), down from about 20 million in 2019 |
| AES-256 under Grover | Roughly 128 bits of effective security, which remains adequate |
| ML-KEM-768 sizes | Public key 1,184 bytes and ciphertext 1,088 bytes, versus 32 bytes for an X25519 key |
| ML-DSA-65 sizes | Public key 1,952 bytes and signature about 3,309 bytes, versus 64-byte Ed25519 signatures |
| Mosca's inequality | If secrecy lifetime plus migration time exceeds the time until a quantum computer, you are already late |
Where quantum computing could help
Migrating to post-quantum cryptography
The problem: Cryptography is embedded in protocols, hardware, firmware, certificates, and third-party products, often without a complete inventory. Replacing it is a multi-year engineering program, and some devices cannot be updated.
The quantum approach: Adopt the NIST-standardized algorithms, first in hybrid mode that combines a classical and a post-quantum scheme, and build crypto-agility so algorithms can be swapped without redesigning systems.
Where things stand: Deployment has already started. Major browsers and cloud providers use hybrid key exchange based on ML-KEM for a large and growing share of web traffic, and messaging systems such as Signal and iMessage have added post-quantum protection. Guidance from NIST, the U.S. National Security Agency, the UK National Cyber Security Centre, and the European Union gives dates between about 2030 and 2035 for retiring vulnerable algorithms.
Related algorithms: Shor's Algorithm, Grover's Algorithm
Assessing harvest-now-decrypt-later risk
The problem: Adversaries can store encrypted traffic today and decrypt it when quantum computers arrive, so any data with a long confidentiality lifetime, such as health records, state secrets, and intellectual property, is already at risk.
The quantum approach: Organizations classify data by required secrecy lifetime, estimate migration time, and compare with expert timelines for quantum capability, prioritizing systems where the lifetimes exceed the expected time to a capable machine.
Where things stand: Expert surveys put a cryptographically relevant machine somewhere in the 2030s, with wide uncertainty. The lack of a firm date is the reason many agencies advise starting now.
Related algorithms: Shor's Algorithm, Quantum Phase Estimation (QPE)
Quantum key distribution and certified randomness
The problem: Some users want security that does not rely on computational assumptions, and everyone needs good random numbers for keys.
The quantum approach: Quantum key distribution lets two parties generate shared keys by sending single photons and detecting eavesdropping through the disturbance it causes. Quantum random number generators use quantum processes as entropy sources, and 2025 work with trapped-ion hardware demonstrated randomness that can be certified.
Where things stand: QKD networks exist, including long fiber and satellite links in China and national projects in Europe. However, agencies such as the NSA and the UK NCSC advise using post-quantum cryptography instead of QKD for most purposes, because QKD needs special hardware and has distance and side-channel limits.
Related algorithms: BB84 Quantum Key Distribution, E91 Quantum Key Distribution, Device-Independent Quantum Key Distribution
Quantum-assisted defense and detection
The problem: Security teams look for intrusions, malware, and anomalies in large data streams.
The quantum approach: Quantum machine learning for anomaly detection and optimization of security configurations has been proposed.
Where things stand: These are research topics. Demonstrations are on small data, and strong classical machine learning tools are widely used, so there is no evidence of advantage.
Related algorithms: Quantum Anomaly Detection, Quantum Kernel Estimation
Who is working on it
- NIST, which ran a multi-year competition and published ML-KEM, ML-DSA, and SLH-DSA in 2024, with additional standards in progress, including a Falcon-based signature and HQC.
- The U.S. National Security Agency, which published the CNSA 2.0 suite and timelines for national security systems, and the UK NCSC, which set milestones for 2028, 2031, and 2035.
- Cloud and technology companies including Google, Cloudflare, Apple, Microsoft, Amazon, and Signal, which have deployed hybrid post-quantum key exchange.
- Telecom and QKD providers such as Toshiba, ID Quantique, and SK Telecom, and national networks in China and the European Union.
- Researchers who continually refine resource estimates for Shor's algorithm, including Craig Gidney and Martin Ekerå.
Realistic timeline
| Horizon | What to expect |
|---|---|
| Now to 2030 | Inventory cryptography, deploy hybrid post-quantum key exchange, and begin replacing signatures in long-lived systems. Government timelines begin to bite. |
| 2030 to 2035 | Vulnerable public-key algorithms are deprecated and then disallowed in many regulated settings. Remaining legacy systems become the main risk. |
| 2035 and later | Quantum computers capable of breaking RSA and elliptic curves may exist. Organizations that migrated are protected, and those that did not face exposure. |
How to judge quantum claims in this sector
In cybersecurity, the loudest quantum claims are usually about threat timing, and the honest answer is that nobody knows the date. Resource estimates for Shor's algorithm have fallen by more than an order of magnitude in six years, which is why planners treat the risk as real. At the same time, no machine today has more than a few thousand noisy physical qubits, and logical qubits remain in the dozens, so claims that encryption is already broken should be rejected.
Product claims need similar care. A vendor selling quantum key distribution should explain how its devices resist side-channel attacks, how keys are authenticated, and why it is a better choice than post-quantum cryptography for the threat in question. A vendor claiming quantum-safe products should name the algorithms, the standards they follow, and whether they use hybrid modes. Cryptographic agility, meaning the ability to change algorithms without rebuilding systems, is a better signal of readiness than any single product.
What stands in the way
- Inventory: many organizations do not know where cryptography is used.
- Performance and size: post-quantum keys and signatures are larger than elliptic-curve ones, which strains constrained devices and protocols.
- Long-lived hardware: embedded systems, satellites, and industrial equipment may be unpatchable.
- Maturity: newer algorithms get less cryptanalysis than RSA, which argues for hybrid deployment and agility.
What organizations in this sector should do now
- Build a cryptographic inventory, a list of every system, library, and vendor that uses public-key cryptography.
- Classify data by confidentiality lifetime and prioritize anything that must stay secret past the early 2030s.
- Adopt crypto-agility so that algorithms can be changed by configuration, and test hybrid post-quantum key exchange now.
- Ask vendors for their post-quantum roadmaps and include them in procurement requirements.
Myths versus reality
- Myth: quantum computers will break all encryption. Reality: symmetric ciphers and hashes are only modestly affected, and AES-256 remains safe.
- Myth: QKD is the fix. Reality: most agencies recommend post-quantum cryptography, which runs on ordinary hardware.
- Myth: there is plenty of time. Reality: data can be harvested now, and large migrations take many years.
The bottom line
Cybersecurity is the sector where quantum computing already changes what organizations must do. The safe approach is to treat migration as an engineering program with a deadline, not as a bet on a hardware date, and to avoid both complacency and panic.
Frequently asked questions
Can quantum computers break encryption today?
No. Breaking RSA-2048 is estimated to need under a million high-quality physical qubits running for days, and current machines have far fewer.
What is post-quantum cryptography?
A set of classical algorithms, such as ML-KEM, ML-DSA, and SLH-DSA, designed to resist attacks by both classical and quantum computers. NIST published the first standards in August 2024.
What is harvest now, decrypt later?
An attack in which an adversary records encrypted data today to decrypt it once quantum computers are available. It makes migration urgent for long-lived secrets.
Is QKD better than post-quantum cryptography?
It offers a different kind of security but needs special hardware and has limits. Agencies such as the NSA and NCSC recommend post-quantum cryptography for most uses.
What should my organization do first?
Inventory where cryptography is used, prioritize long-lived data, adopt hybrid key exchange, and require post-quantum roadmaps from vendors.
Keep exploring
- Algorithm: Shor's Algorithm
- Algorithm: Grover's Algorithm
- Algorithm: BB84 Quantum Key Distribution
- Algorithm: Device-Independent Quantum Key Distribution
- Hardware: Google Willow
- Hardware: Quantinuum H2
- Company: IonQ
- Company: Quantinuum
- Company: Google (Google Quantum AI)
- Research: Case Study: Post-Quantum Cryptography Migration in a Large Financial Institution
- Research: Prototype Quantum Repeater Demonstrates Entanglement Distribution Over Extended Fiber Distance
- Industry: Quantum Computing for Finance
- Industry: Quantum Computing for Insurance
- Industry: Quantum Computing and the Public Sector
- Industry: Quantum Computing for Telecommunications
- Industry: Quantum Technology for Space and National Security
This page is written for educational purposes and summarizes public announcements, published research, and published resource estimates (last reviewed September 30, 2026). Vendor and customer claims have not all been independently verified, timelines are estimates, and nothing here is investment or business advice.