Some of the world’s largest technology providers have set 2029 deadlines to protect their services from future cyber threats based on emerging quantum technology. For their customers, that sounds reassuring, but each commitment covers only the technology that provider controls. A mid-sized business may still rely on older devices, certificates, backup systems and specialist applications outside its main provider’s remit. The major platforms could be ready on time while the customer’s business remains exposed because no single supplier owns the transition across its entire technology estate.
That raises a fair question for UK mid-sized businesses already occupied with AI adoption, cloud security and the threats in front of them today. Do quantum threats really deserve to become yet another priority? To some degree, yes. Most organisations do not need a standalone quantum cyber security programme, but the issue should already be influencing decisions about long-lived data, technology purchases and supplier renewals. The threat does not begin on the day a powerful quantum computer goes live in some malign state agency.
An attacker who steals encrypted information today may be unable to read it immediately, yet that does not make the theft worthless. The data can be stored until the computing power exists widely enough to unlock it – this happens with quantum computing. Known as harvest now, decrypt later, this type of attack leaves no ransom note and may give the victim no reason to suspect that a usable copy has gone. Information that remains sensitive for years is the biggest concern and this sort of pre-emptive data theft is already being seen as a real risk.
The risk is not equal across every file. Routine operational data may have little value a decade from now, while intellectual property, legal material or information about people could still cause harm. That gives CISOs a more useful starting point than trying to predict the arrival of a powerful quantum computer: which information taken from the business today would still matter if somebody could only read it years later?
You don’t need to predict Q-Day to prepare for it
Quantum computers exist today only in exotic research labs and are some way from the IT mainstream: no credible authority has given any idea of when this might happen. Nor would the more widespread adoption of quantum computing break every form of encryption overnight. The concern centres on the public-key encryption used today to establish secure connections, verify identity and confirm that software is genuine. Whilst secure today, quantum computers will be able to break even the most secure current forms of public-key encryption in a few days or even hours. As a result, new forms of encryption designed to be more resistant to quantum attacks are now moving into mainstream technology.
NIST finalised its first post-quantum cryptography standards in 2024. Microsoft aims to move its products and services to the new protection by 2029 and has begun adding support to Windows and Windows Server. Google Cloud has published a 2029 target, while the NCSC wants UK organisations to complete discovery and planning by 2028, address their highest-priority systems by 2031 and finish migration by 2035.
These dates are planning horizons rather than predictions of Q-Day, the point at which a quantum computer can break the public-key encryption widely used today. On one hand, they show that the migration will take years. On the other, they also risk giving customers a false sense that the problem has been contained, when each deadline really marks the limit of a provider’s responsibility.
Google Cloud is unusually clear about that boundary. It will update the technology used to run its cloud services, while customers remain responsible for their applications, devices, encryption keys and security settings. The same division applies to Microsoft and other major platforms. Their work matters, but it cannot update every product or app connected to them.
Your supplier’s readiness is not your readiness
The mid-market challenge sits in the connections between providers. Cloud services still need to work with older software, internal certificate systems, network equipment and backup products, all moving at different speeds. A platform may introduce quantum-resistant protection while an older application cannot use it. A backup may encrypt its contents securely while the method protecting the key that unlocks it remains vulnerable. One supplier can complete its preparations and still leave the customer exposed through a system beyond its control.
For mid-sized firms, the most useful response begins with decisions already being made today. Hardware bought this year could still be running in 2031 when the NCSC recommends priority migrations to be complete. A long software renewal could bind the business to an application that cannot adopt stronger encryption without being rebuilt or replaced. Procurement and contract renewal are therefore the moments when future exposure can be reduced before it becomes an expensive migration problem.
Asking a supplier whether a product is quantum-ready invites a broad assurance. Buyers need to know which products will change, whether the transition requires new hardware or additional cost, what the customer must configure and who owns any technology that cannot be updated. A roadmap has little value unless it makes those responsibilities clear.
Managed security providers should face the same scrutiny. Working on a major platform with a funded post-quantum programme is an advantage, but a provider cannot just assume they will inherit Microsoft’s readiness and pass it on wholesale. Its useful role is to interpret platform changes across the customer’s wider environment and keep gaps visible as contracts and equipment approach renewal. For a Microsoft security specialist, this is the practical point where changes to the platform meet the reality of a customer’s estate, and conventional XDR techniques can play an important role in detecting and preventing harvest now, decrypt later data attacks.
Q-Day cannot be predicted, but mid-sized businesses shouldn’t wait for a confirmed date to start preparing. They can still identify the information that must remain confidential for years, understand which systems and make quantum readiness part of purchasing and renewal decisions. The practical deadline is the next decision that could lock vulnerable technology into the business for another five or 10 years.
Gary Owen is solutions lead at Softwerx
