Quick answer
Quantum computers capable of breaking current public-key encryption (RSA, ECC) don't exist yet, and may be a decade or more away. But data encrypted today can be captured and stored now, then decrypted later once the technology matures — a risk called "harvest now, decrypt later." For data that needs to stay confidential for 10+ years (health records, government, long-term IP), starting a migration plan to post-quantum cryptography now is reasonable. For most everyday enterprise data, monitoring the standards and planning ahead of mandates is enough for now.
Quantum-safe cryptography sounds like a problem for the distant future, and mostly it still is — but the reason security teams are starting to act now is more specific than general future-proofing, and it's worth understanding even if you decide not to act yet.
The actual threat: "harvest now, decrypt later"
A sufficiently powerful quantum computer could, in theory, break the public-key cryptography (RSA, ECC) that secures most of today's internet traffic and stored data. That computer doesn't exist yet. But an adversary doesn't need it to exist today — they can intercept and store encrypted data now, and simply wait until quantum computing catches up to decrypt it later. For data with a long confidentiality shelf life, that's a real risk today, not a future one.
Who actually needs to worry about this now
The calculus depends entirely on how long your data needs to stay secret. A one-time payment token that's irrelevant in 90 days isn't a harvest-now target worth worrying about yet. Health records, government and defense data, long-lived intellectual property, and legal/financial records with decade-plus retention requirements are a different story — that data being decrypted in 10-15 years is a genuine risk to plan for today.
What's actually available today
NIST finalized its first set of post-quantum cryptography standards in 2024 (ML-KEM, ML-DSA, and others), so the "we don't know what to migrate to" excuse is largely gone. Several major cloud providers and browsers have already started rolling out hybrid classical/post-quantum key exchange as a transitional step, meaning some of this migration is happening underneath you already without requiring you to build anything custom.
A practical starting point, not a panic response
You almost certainly don't need to rip out and replace your cryptography this year. A reasonable first step is a cryptographic inventory — knowing which systems use which algorithms, and which handle genuinely long-lived sensitive data — so that when a migration does become necessary (whether by maturity of the standards or by a future compliance mandate), you're not starting from "we don't even know where encryption is used." That inventory work is valuable regardless of how quantum computing timelines play out.
Where this fits with governance
This is part of the same discipline as the AI governance work we do — knowing what's running, where, and under what risk profile, before a regulator or a real incident forces the question. See our note on AI Governance & Cost Compliance for the adjacent discipline on the AI side.
A cryptographic inventory is a small, well-scoped first project — reach out if it's worth a conversation.