Should You as a CISO Prepare for Quantum Threats Now?

Yes, as a CISO you need to prepare for quantum threats now, even though powerful quantum computers capable of breaking current encryption are not yet widely available. The reason is simple: attackers are already collecting encrypted data traffic today to decrypt it later once quantum technology makes that possible. This article answers the most frequently asked questions about quantum risks, post-quantum cryptography, and what you as a CISO can concretely do to protect your organization.

How real is the quantum threat today?

The quantum threat is already real today, even without a quantum computer existing right now that can break common encryption. The danger lies in the so-called harvest now, decrypt later attack: malicious actors intercept large volumes of encrypted data traffic now and store it, expecting that a future quantum computer will be able to decrypt that data. For sensitive information with a long lifespan, this is an acute risk.

Most cryptographic experts and government agencies expect that cryptographically relevant quantum computers will become a reality somewhere in the next ten to fifteen years. Some estimates assume a shorter timeline. What is certain: the migration time to quantum-safe cryptography is long. Those who wait now will fall behind later.

For sectors such as critical infrastructure, defense, healthcare, and financial services, the threat is especially urgent. Data that must remain confidential now and still needs to be in five or ten years is already vulnerable to harvest now, decrypt later attacks. The quantum threat for CISOs is therefore no longer a future concern, but a strategic issue for today.

Which systems and data are most at risk?

Systems and data face the greatest quantum risk when they use asymmetric cryptography such as RSA, ECC, or Diffie-Hellman, and when the confidentiality of the data must be guaranteed over a longer period. Quantum computers are specifically capable of solving the mathematical problems on which these algorithms rely.

The most vulnerable categories are:

• Long-term confidential data: patient records, legal documents, state secrets, intellectual property
• Critical network infrastructure: VPN connections, TLS sessions, certificate management, and key exchange
• Authentication systems: digital signatures, PKI infrastructure, and identity management
• Data center connections and WAN links: encrypted transport between locations and cloud environments
• OT and IoT environments: devices with a long lifespan that are being installed now and are difficult to update

Symmetric encryption such as AES-256 is less vulnerable, but here too key exchange often takes place via asymmetric methods. That link is the weakest point in the chain. A thorough approach to sensitive data therefore starts with mapping which cryptographic methods you use throughout your infrastructure.

What are the NIST post-quantum standards and what do they mean for your organization?

The NIST post-quantum standards are a set of cryptographic algorithms selected and published by the American National Institute of Standards and Technology as replacements for current encryption that is vulnerable to quantum computers. In 2024, NIST published the first definitive standards: ML-KEM (for key exchange), ML-DSA and SLH-DSA (for digital signatures).

For your organization, these standards mean in practice:

• A reference point for migration: vendors and governments worldwide are moving toward these standards, meaning that software, hardware, and protocols will be updated in the coming years
• Compliance implications: European regulations and sector-specific frameworks (such as NIS2 and DORA) are expected to align with the NIST standards or comparable European equivalents
• Procurement decisions: new network equipment, encryption solutions, and certificate management must demonstrably be or become quantum-safe
• Transition planning: hybrid cryptography, where classical and post-quantum algorithms are used in parallel, is the recommended intermediate step

The NIST post-quantum standards provide direction, but they do not automatically solve the migration challenge. Your organization must determine for itself which systems are addressed first and at what pace the transition takes place.

When should a CISO start migrating to quantum-safe cryptography?

A CISO should start preparing for the migration to quantum-safe cryptography now, not only when quantum computers become operational. Experts estimate the migration time for large organizations at five to ten years, depending on the complexity of the infrastructure. Those who wait too long will miss the window to protect data that is already being intercepted today.

The urgency varies by organization. Factors that determine how quickly you need to act:

• Data sensitivity: the longer data must remain confidential, the more urgent the migration
• Infrastructure complexity: larger and more complex environments require more time for inventory and migration
• Vendor dependency: migration is partly dependent on when vendors release quantum-safe updates
• Regulatory requirements: governments and regulators are setting increasingly concrete deadlines for cryptographic resilience

The most pragmatic approach is phased: start with a cryptographic inventory, identify the highest risks, and begin the migration there. Don’t wait for a perfect solution for the whole.

How do you start a quantum risk analysis for your network infrastructure?

You start a quantum risk analysis for your network infrastructure by creating a complete inventory of all cryptographic algorithms and keys your organization uses. This is also known as a cryptographic inventory or cryptographic bill of materials. Without this overview, you don’t know where you are vulnerable.

Follow these steps as a starting point:

1. Map all cryptographic applications: VPNs, TLS certificates, digital signatures, key exchange, authentication systems, and transport-level encryption
2. Classify data by sensitivity and lifespan: which data must still be confidential in five or ten years?
3. Identify vulnerable algorithms: RSA, ECC, and Diffie-Hellman are the priority for replacement
4. Assess vendor dependencies: which systems depend on external updates for quantum safety?
5. Establish a risk ranking: prioritize based on sensitivity, exposure, and migration complexity

For the network layer specifically, it is wise to look at protection against quantum threats at both the transport and application layers. Many organizations underestimate how deeply cryptography is embedded in their network infrastructure, from management connections to data center links.

What is layer 1 and layer 2 encryption and why is it quantum-relevant?

Layer 1 encryption secures data traffic at the physical level of the OSI model, directly on the fiber or transmission medium. Layer 2 encryption operates at the data link layer level and encrypts Ethernet frames before they enter the network. Both methods are quantum-relevant because they apply encryption at the lowest level of the network stack, independent of higher application layers.

Why layer 1 and layer 2 encryption can be vulnerable

Encryption at layers 1 and 2 also uses key exchange and authentication, and these are often based on asymmetric cryptography. That is precisely the weak link in a post-quantum world. If the key exchange is vulnerable, the encryption itself offers little protection against an attacker who is storing encrypted traffic now.

Why layer 1 and layer 2 encryption also presents opportunities

At the same time, encryption at these layers offers a strategic advantage: it encrypts all data at the transport level, regardless of which applications run on top. This makes it an efficient way to provide broad protection, including for traffic that is not separately encrypted at higher layers. Quantum-safe variants of layer 1 and layer 2 encryption are in development and offer a future-proof approach for organizations looking to protect their network infrastructure.

We have been working with layer 1 and layer 2 encryption for years for organizations in sectors where data security at the transport level is business-critical. View our encryption solutions for an overview of what is possible within your infrastructure. The combination of in-depth network expertise and a vendor-independent approach makes it possible to make the right choice, including for the step toward quantum-safe encryption. Want to know how to assess your current infrastructure for cryptographic vulnerabilities? Our experts are happy to think along with you via our security solutions page.