Artificial intelligence (AI) is already changing how businesses operate. Quantum computing could eventually change which problems they can solve, and break security assumptions they have relied on for decades.
That leaves executives facing a question bigger than whether to invest in the next wave of technology:
When the foundations of digital trust change, will your business still be a company others can trust?
That is what the migration to post-quantum cryptography, or PQC, is really about. It reaches into operations, investment, supply chains, customer relationships and information that must remain confidential long after today’s contracts have expired.
Some leadership teams still treat quantum readiness as a technical problem for another day. That is a comfortable position, until they discover how much of their business depends on cryptography they cannot see, control or quickly replace.
Opportunity and Exposure Are Moving Together
AI gives businesses the ability to analyze information, automate work and generate insights at extraordinary scale. Quantum computing may eventually offer advantages for certain specialized problems, including molecular simulation and potentially some optimization tasks.
The two technologies could reinforce each other. But quantum computers are not magic accelerators for every AI application. Their commercial impact will depend on the problem, the algorithms and continued progress in hardware.
The security threat is more specific, and harder to ignore.
A sufficiently capable quantum computer could undermine public-key cryptography used to establish secure connections and verify digital identities. You do not need to own a quantum computer to be exposed. Your customers, infrastructure and communications already depend on the systems at risk.
Strong Encryption is Not The Whole Story
Let’s kill one misleading claim: AES-256 will not suddenly become useless because quantum computing arrives.
AES-256 remains a strong symmetric encryption algorithm. Quantum search techniques affect its theoretical security margin, but they do not reduce its protection to zero. The more disruptive threat targets public-key systems such as RSA and elliptic-curve cryptography.
That distinction matters. A company can use AES-256 to encrypt sensitive data while relying on quantum-vulnerable methods to establish or protect the keys.
So, when someone says, “We use strong encryption,” the next question should be: How are the keys protected?
Leadership also needs to know how identities are authenticated, how software updates are trusted and where vulnerable cryptography is embedded across the business, including in systems nobody has examined for years.
PQC addresses these risks through algorithms designed to resist attacks from both classical and quantum computers. It runs on conventional computing infrastructure. You do not need a quantum computer to deploy it. NIST finalized its first three PQC standards in August 2024.
The Business Clock is Already Running
Executives can spend years debating when a cryptographically relevant quantum computer will arrive. That debate does not answer the question they need to act on.
Three timelines matter:
- Information lifetime: How long must sensitive information remain confidential?
- Migration time: How long will discovery, procurement, testing and deployment take?
- Threat arrival: When might an adversary gain the capability to defeat vulnerable cryptography?
The third timeline is uncertain. The first two are yours to investigate now.
Suppose proprietary engineering information needs to remain confidential for fifteen years. An adversary can record communications protected by vulnerable key algorithms today and keep them until a future quantum capability makes decryption possible. By then, the information may still be valuable, and the damage may already be impossible to prevent.
That is the risk behind harvest now, decrypt later. An upgrade next year cannot reach into an adversary’s archive and protect what was collected today.
Meanwhile, migration is not a software patch you push on a Friday afternoon. It involves certificates, applications, network equipment, cloud services, industrial systems and suppliers. NIST advises organizations to begin identifying vulnerable algorithms and planning their replacement.
The deadline is not simply the day a quantum computer breaks today’s cryptography. It is that date minus the time your business needs to prepare.
Your Customer May Set the Deadline for You
There is another way this lands on the executive desk: a customer asks for proof.
Imagine a major customer has invested in quantum-resistant communications. Your connection cannot meet its protection requirements. Your team cannot explain where vulnerable cryptography remains, and your supplier has no credible migration roadmap.
You may be a trusted partner today. That does not guarantee the customer will accept the risk tomorrow. An unprepared supplier is not automatically malicious, and an incompatible connection is not automatically an attack. But it can become an exposure a customer is unwilling to accept.
As organizations raise their security requirements, expect tougher questions:
- Which connections support PQC?
- Which identities and signatures remain vulnerable?
- What sensitive information crosses organizational boundaries?
- What is the migration plan?
- Has interoperability been tested?
These requirements will not appear everywhere at once. But the commercial logic is straightforward: when customers change their security standards, suppliers must be ready to respond.
Your first encounter with quantum risk may come through a procurement questionnaire, a contract renewal or an integration requirement, not a quantum-enabled attack.
This is a Business Program, Not a Science Project
The transition is already reflected in official guidance. The UK’s National Cyber Security Centre recommends discovery and initial planning by 2028, completion of highest-priority migration activities by 2031, and completion of migration by 2035. Those are UK guidance milestones, not a universal legal deadline or a prediction of when a quantum computer will arrive.
For boards and executives, the starting point is ownership, visibility and a funded plan.
Find out where cryptography supports critical operations. Identify information that must remain confidential for years and systems whose failure would have serious consequences. Demand credible roadmaps from suppliers. Test changes under real operating conditions. Build the agility to update cryptography again as standards and threats evolve.
For critical infrastructure, that work must also protect availability, safety and performance throughout the transition.
At Patero, we frame the objective around three connected needs: understand cryptographic exposure, protect critical communications and develop the agility to change without disrupting operations.
AI and quantum computing may reshape how businesses create value. PQC migration will help determine whether they can protect that value and prove they are still trustworthy partners.
When your biggest customer asks for evidence, will you have an answer or an excuse?
Is your organization ready to prove it?
Carahsoft is offering a day-two engagement you can start this week.
Have you patched PHP, GitLab and Node? What you can’t answer yet is which certificates and keys were reachable from those hosts, what still trusts them, and whether rotation actually completed—plus which OT and embedded devices still chain to the revoked eMudhra intermediates.
That is a bounded, two-day scope: Patero’s nQrypt platform discovers the cryptographic material on the exposed systems, maps dependencies, drives reissuance through your existing tooling, and delivers a live-validated attestation with provenance.
Metadata only, non-disruptive on operational networks and it leaves you with the inventory you will need before the next one.
Email Patero@carahsoft.com for details.
Carahsoft Technology Corp. is The Trusted Government IT Solutions Provider, supporting Public Sector organizations across Federal, State and Local Government agencies and Education and Healthcare markets. As the Master Government Aggregator for our vendor partners, including Patero, we deliver solutions for Geospatial, Cybersecurity, MultiCloud, DevSecOps, Artificial Intelligence, Customer Experience and Engagement, Open Source and more. Working with resellers, systems integrators and consultants, our sales and marketing teams provide industry leading IT products, services and training through hundreds of contract vehicles. Explore the Carahsoft Blog to learn more about the latest trends in Government technology markets and solutions, as well as Carahsoft’s ecosystem of partner thought-leaders.
