Three in five firms prepare for quantum computing security threat

New research from Thales reveals that only three in five organisations are preparing for the risks posed by quantum computing to current data security measures.

The company's latest Data Threat Report draws on survey responses from over 3,100 IT and security professionals, spanning 20 countries and representing 15 industries. It underscores the challenge and urgency of adapting to a future in which quantum computers could potentially decrypt today's sensitive data encrypted with classical algorithms.

Readiness rates

Findings from the report indicate that 60% of surveyed organisations are in the process of prototyping or evaluating quantum-resistant encryption. Despite this, the report notes that the transition to post-quantum cryptography is highly complex and urgent, given the threat quantum computers pose to existing security infrastructure.

Half of respondents stated that they are currently reassessing their encryption strategies. Their main priorities include evaluating post-quantum cryptographic (PQC) algorithms, enhancing cryptographic agility, and formulating comprehensive encryption strategies to strengthen defences against quantum-enabled attacks.

According to the report, 33% of organisations plan to depend on cloud providers or telecommunications companies to implement post-quantum encryption. Thales points out that although this may provide short-term convenience, it risks creating a fragmented and inconsistent encryption environment.

The addition of new security layers to existing key management systems presents another challenge. The report finds that 57% of enterprises already manage five or more key management systems. Introducing post-quantum cryptography increases the risk of misconfigurations, operational mistakes, and possible data exposure.

Concerns on the rise

Concern about the impact of quantum computing on data security has grown over the past four years. In 2021, 47% of organisations reported being 'very concerned' about quantum risks, with another 38% 'somewhat concerned'. These concerns have become more specific, with 58% expressing worry about network decryption in 2022 and 62% reiterating this concern in 2023.

For 2024, the leading concerns have shifted towards the potential compromise of encryption itself (68%) and vulnerabilities in key distribution (63%). By 2025, 63% of respondents continued to cite future encryption compromise as a worry, while 61% were concerned about distribution of keys, and 58% remained fearful of future decryption of current, sensitive data.

This development indicates that organisations are not only increasingly aware of quantum threats but are also focusing on the specific mechanisms by which quantum computing could undermine secure data.

"The clock is ticking on post-quantum readiness, and quantum threats are no longer theoretical, they're rapidly becoming a real-world challenge for security teams." said Chris Harris, EMEA Technical Director at Thales.

He continued, "While it's promising to see three out of five organisations beginning their post-quantum journeys, fragmented strategies and overreliance on third parties risk leaving critical data exposed. True quantum readiness demands cohesive strategies, cryptographic agility, and urgent action to safeguard today's data against tomorrow's quantum capabilities."

Harris also noted the significance of quantum technology in the UK's strategic planning: "The UK's Industrial Strategy makes clear that quantum technologies will play a critical role in the nation's economic growth, national security, and innovation leadership. But as the UK accelerates quantum development, we must also prepare for the serious security implications. With threats such as 'harvest now, decrypt later' already acknowledged by the NCSC and global agencies, building quantum advantage must go hand-in-hand with building quantum resilience. That means fast-tracking post-quantum cryptography adoption, mandating crypto-agility in digital infrastructure, and maintaining sovereign key management across cloud and hybrid environments. The stakes are too high for complacency."

Industry response

Justin Walker, Vice President Digital Solutions at Thales UK, emphasised the current responsibilities facing organisations. He said, "Post-quantum readiness isn't just about future-proofing encryption, it's about protecting the sensitive data at the heart of our national infrastructure today. At Thales, we're uniquely positioned to support organisations on this journey. Through our consulting expertise, we can help audit cryptographic assets, identify areas of risk, and prioritise where post-quantum safeguards – such as crypto-agile key management and quantum-resistant encryption – should be implemented first. Our combination of leading technology and deep advisory capability means we can deliver both the strategic roadmap, and the operational tools needed to achieve true quantum resilience."