Post-Quantum cryptography is a present business risk requiring action

There are still those who, when they hear about the risks of quantum computing, seem as if they are being told about risks derived from science fiction scenarios. And for many, opening the conversation about the threats it may pose to security often leads to the same question: when will a quantum computer capable of breaking current cryptographic systems arrive? For others, sometimes even the same people, the question that arises, not without some irony, is: will we ever really have quantum computers that pose a security threat?

But, perhaps these are not the most relevant questions.

In truth, although we do not know for certain when we will have a cryptographically relevant quantum computer, or even if we will ever have one, we do know that preparing for that scenario can take years. And there lies the paradox: should we wait for the threat to become a reality before we start protecting ourselves, or should we anticipate risks whose full impact we still do not know, but whose preparation requires time, resources, and planning?

Cryptography is much more present in our organizations than we usually perceive. It protects communications, intervenes in certificates, device identities, code signatures, software and firmware integrity, applications, networks, management platforms, or services provided by third parties. It is a kind of invisible infrastructure upon which we have built a large part of digital trust. Changing it is not simply a matter of replacing one algorithm with another.