There is a comfortable phrase that can kill a company’s preparation for a serious threat:
“We’re monitoring the situation.”
It sounds responsible. It costs almost nothing. And it allows everyone in the boardroom to move on to something with a cleaner return on investment (ROI).
For Chief Executive Officers (CEOs) postponing post-quantum cryptography, or PQC, that phrase deserves scrutiny. Monitoring a threat does not reduce exposure to it. Eventually, somebody has to own and fund the work.
Quantum computing already exists. The unresolved question is when a sufficiently powerful quantum computer will be able to break widely used public-key cryptography, including RSA and elliptic-curve systems. These technologies underpin secure connections, identity verification and digital signatures across modern business. The National Institute of Standards and Technology (NIST) has already started the process of cipher deprecation with a deadline of fully migrating by 2033.
The arrival date of a cryptographically relevant quantum computer remains uncertain. The need to prepare does not. Especially with a hard compliance date identified.
Why Quantum Risk Falls Off the Executive Agenda
Why, then, does preparation keep losing its seat at the executive table?
The most convincing explanation is an ugly mismatch between corporate incentives and the time required to manage this risk.
A CEO gets measured on revenue, margins, growth and execution. A cryptographic migration consumes money and engineering time while producing something difficult to celebrate: a disaster that does not happen. There is no ribbon-cutting ceremony for replacing vulnerable key exchanges. Nobody applauds a certificate inventory. Except, maybe the Chief Information Security Officer (CISO) and their respective team(s)
The spending is visible. The avoided loss is esoterically hypothetical.
Until it isn’t.
Another obstacle is the language. Talk about lattices, key encapsulation and cryptographically relevant quantum computers, and an executive can easily decide this belongs several floors below the boardroom. But the business questions are straightforward: How long must our information remain confidential? Which products depend on vulnerable cryptography? How long will cipher replacement take? Who owns the answer and the process?
A CEO does not need to understand the math. A CEO does need to rally the executive team, assign a lead and hold that team, CEO included, accountable.
The False Security of Vendor Reliance
Then comes the vendor excuse.
“Our cloud provider will handle it.”
Perhaps the provider will handle its portion. That still leaves applications, private infrastructure, embedded devices, partner connections and equipment purchased years ago. A vendor’s roadmap cannot substitute for understanding operational dependencies. NIST’s migration guidance explicitly treats cryptographic discovery and inventory as foundational work.
Outsourcing technology does not outsource the consequences of getting it wrong.
The most dangerous excuse, however, is uncertainty about timing. Executives understandably dislike spending against things they can’t touch or quantify. But waiting for certainty assumes the company can migrate faster than today’s threats develop.
That is quite the assumption to make about an organization that needs three committees to replace a customer database.
Cryptography is buried throughout enterprise systems. Changing it requires discovery, testing, procurement, coordination and sometimes hardware replacement. NIST warns that waiting until a quantum computer can crack vulnerable cryptography would leave insufficient time to migrate before damage occurs.
Today’s Data, Tomorrow’s Threat
The first harm may involve information the company loses today.
“Harvest now, decrypt later” describes the collection of encrypted information for possible decryption once quantum capabilities become sufficient. A stolen archive can remain valuable long after the original intrusion. Research, medical information, trade secrets and sensitive communications may need confidentiality for decades. Upgrading security later cannot recall copies already in an adversary’s possession.
Imagine spending ten years building a proprietary manufacturing process, then discovering that intercepted communications have exposed the work. The damage extends beyond incident response. A competitor potentially gains years of research without paying for the failures that produced it.
The company can replace its encryption. Replacing its competitive advantage is harder.
The threat also reaches beyond confidentiality. Vulnerable digital signatures could undermine the mechanisms used to authenticate users, devices and software. Depending on the system, that could enable impersonation, forged updates or manipulation of information that appears trustworthy.
For a business, those failures could mean interrupted operations, disputed transactions, compromised products and expensive recovery. For customers, they could mean discovering systems they trusted, no longer provides reliable proof of who or what they are dealing with.
When Cybersecurity Becomes a Leadership Liability
For the CEO, the consequences become intensely personal.
A board may tolerate uncertainty about a scientific breakthrough. It may be less forgiving of an executive who never commissioned an inventory, assigned an owner or funded a credible plan. Lost contracts, emergency spending and damaged customer relationships create questions that cannot be answered with a slide about “ongoing monitoring.”
None of this guarantees lawsuits, dismissal or corporate collapse. Outcomes depend on the exposure and the decisions involved. But ignoring preparation creates an avoidable leadership vulnerability: a record of delay after practical defensive options became available.
From Monitoring Risk to Taking Action
Those options are real. NIST finalized its first three PQC standards in August 2024. The UK’s National Cyber Security Centre has also set out a phased migration roadmap, targeting completion by 2035. That is a planning horizon, not a promise that vulnerable systems remain safe until then.
The sensible response is to start with evidence. Identify cryptographic dependencies. Prioritize information that must remain secret longest and systems that will take the longest to replace. Demand concrete vendor commitments. Test changes. Build the ability to change cryptography again as standards and threats evolve.
This requires money, ownership and sustained attention. It also requires resisting the temptation to buy a reassuring label and declare the problem solved.
CEOs routinely make investments under uncertainty. They enter markets, acquire companies, and finance products without knowing exactly when the payoff will arrive. Quantum preparation deserves the same disciplined judgment.
The executive who waits for a guaranteed date is making a bet with the company’s secrets, its operating resilience and its customers’ trust.
When that bet comes due, “we were monitoring the situation” will sound exactly as useful as it was.
Learn more about how Patero’s PQC solutions are protecting Government agencies from evolving cyber threats.
For more information, reach out to our team at Patero@Carahsoft.com.
Carahsoft Technology Corp. is The Trusted Government IT Solutions Provider, supporting Public Sector organizations across Federal, State and Local Government agencies and Education and Healthcare markets. As the Master Government Aggregator for our vendor partners, including Patero, we deliver solutions for Geospatial, Cybersecurity, MultiCloud, DevSecOps, Artificial Intelligence, Customer Experience and Engagement, Open Source and more. Working with resellers, systems integrators and consultants, our sales and marketing teams provide industry leading IT products, services and training through hundreds of contract vehicles. Explore the Carahsoft Blog to learn more about the latest trends in Government technology markets and solutions, as well as Carahsoft’s ecosystem of partner thought-leaders.
