The advent of quantum computing poses significant challenges to classical cryptography and is a threat to secure communication protocols. This has created an urgent need to migrate networked applications to post-quantum cryptography (PQC). Enterprises operating large-scale networks must migrate thousands of applications that rely on cryptographic primitives, each requiring distinct remediation strategies and varying effort. Applications with higher risk profiles must be prioritized. However, budget limitations, skilled-resource availability, and application dependencies make PQC migration planning a challenging task. In this paper, we propose an optimization model that generates a migration plan for enterprise applications, determining which applications should be migrated in each time frame and in what order, such that the overall quantum risk exposure is minimal. We demonstrate the implications of delayed application migration on overall effort estimation and quantum risk exposure as well as the impact on application prioritization due to budget limitations and resource availability.
The advent of quantum computing poses significant challenges to classical cryptography and is a threat to secure communication protocols. This has created an urgent need to migrate networked applications to post-quantum cryptography (PQC). Enterprises operating large-scale networks must migrate thousands of applications that rely on cryptographic primitives, each requiring distinct remediation strategies and varying effort. Applications with higher risk profiles must be prioritized. However, budget limitations, skilled-resource availability, and application dependencies make PQC migration planning a challenging task. In this paper, we propose an optimization model that generates a migration plan for enterprise applications, determining which applications should be migrated in each time frame and in what order, such that the overall quantum risk exposure is minimal. We demonstrate the implications of delayed application migration on overall effort estimation and quantum risk exposure as well as the impact on application prioritization due to budget limitations and resource availability.
The emergence of quantum computing threatens the security of classical cryptographic algorithms such as RSA and ECC. Post-quantum cryptography (PQC) offers mathematically secure alternatives, but migration is a complex, multi-year undertaking. Unlike past transitions (AES, SHA-2, TLS 1.3), PQC migration requires larger parameter sizes, hybrid cryptographic schemes, and unprecedented ecosystem coordination. This paper presents a structured expert synthesis of migration timelines, based on analysis of migration dependencies, historical precedents, and industry engagement. We analyze migration timelines for small, medium, and large enterprises, considering infrastructure upgrades, personnel availability, budget constraints, planning quality, and inter-enterprise synchronization. We argue that realistic timelines extend well beyond initial optimistic estimates: 5–7 years for small enterprises, 8–12 years for medium enterprises, and 12–15+ years for large enterprises under baseline assumptions. PQC migration is not a siloed technical upgrade but a global synchronization exercise, deeply intertwined with Zero Trust Architecture and long-term crypto-agility. These timelines are contextualized against expected arrival windows for fault-tolerant quantum computers (FTQC), projected between 2028 and 2033. We further analyze the “Store Now, Decrypt Later” threat model, crypto-agility frameworks, and provide comprehensive risk mitigation strategies for enterprises navigating this unprecedented cryptographic transition.
Quantum computing is emerging as a significant threat to information protected by widely used cryptographic systems. Cryptographic methods, once deemed secure for decades, are now at risk of being compromised, posing a massive threat to the security of sensitive data and communications across enterprises worldwide. As a result, there is an urgent need to migrate to quantum-resistant cryptographic systems. This is no simple task. Migrating to a quantum-safe state is a complex process, and many organisations lack the in-house expertise to navigate this transition without guidance. In this paper, we present a comprehensive framework designed to assist enterprises with this migration. Our framework outlines essential steps involved in the cryptographic migration process, and leverages existing organisational inventories. The framework facilitates the efficient identification of cryptographic assets and can be integrated with other enterprise frameworks smoothly. To underscore its practicality and effectiveness, we have incorporated case studies that utilise graph-theoretic techniques to pinpoint and assess cryptographic dependencies. This is useful in prioritising crypto-systems for replacement.
With the development of quantum technologies, there is an urgent need to secure existing IT infrastructure against quantum threats. Introducing post-quantum cryptography (PQC) to existing systems may protect them against future quantum computer attacks. Still, post-quantum migration is a cumbersome process that requires systematic planning and takes years. In this paper, we study Estonia's e-government ecosystem, outline systems and products that rely on potentially vulnerable cryptographic primitives, identify the main migration obstacles, and provide recommendations on how the migration process should be carried out.
Quantum computing is no longer a distant concern for cybersecurity planning. Its progress has raised serious questions about the long-term reliability of widely used public-key cryptographic systems, especially RSA, elliptic curve cryptography, and related key exchange mechanisms that currently protect digital communication, cloud services, financial transactions, government systems, and enterprise information assets. The main concern is that powerful quantum algorithms could weaken the mathematical assumptions on which these systems depend, creating future risks for encrypted data, digital signatures, identity systems, and secure network protocols (Shor, 1994; Mosca, 2018). Post-quantum cryptography has therefore become a major cybersecurity readiness priority, not only as a technical replacement for vulnerable algorithms, but as a broader organizational migration challenge. Effective preparation requires cryptographic asset inventory, risk classification, crypto-agility, vendor coordination, interoperability testing, and phased deployment across complex information systems (Kumar, 2022; Campbell, 2025). This article examines the cybersecurity implications of quantum computing and reviews the major post-quantum cryptographic algorithm families, current standardization efforts, enterprise migration barriers, and strategic readiness measures needed for the quantum computing era. It also discusses the importance of aligning post-quantum migration with existing cybersecurity governance, information systems management, and long-term digital resilience planning. By emphasizing early preparation, structured migration, and continuous cryptographic governance, the article argues that organizations can reduce future quantum-related exposure and strengthen the security of critical digital infrastructure before large-scale quantum attacks become practical (NIST, 2024; NCCoE, 2025).
Quantum computing represents a significant threat to the asymmetric cryptographic algorithms currently used to protect the traditional data security infrastructure today’s enterprises depend upon. With Gartner predicting that by 2029 advances in quantum computing will render applications, data and networks protected by asymmetric cryptography unsafe, organisations must begin preparations to transition to post-quantum cryptography (PQC). Organisations that fail to prepare for quantum today risk potentially exposing their sensitive data on a massive scale, as threat actors are already collecting encrypted enterprise data in anticipation of future quantum decryption capabilities. The migration to PQC involves updating risk registers and enabling the crypto agility that supports the rapid implementation of new algorithms and ensures organisations can adapt fast to new regulatory standards.
The advent of quantum computing poses a significant threat to contemporary cryptographic systems underpinning national security infrastructures globally. Classical public-key cryptographic algorithms such as RSA and ECC, which secure communications, data storage, and critical infrastructure, are vulnerable to quantum attacks, particularly through Shor’s algorithm. Post-Quantum Cryptography (PQC) aims to develop quantum-resistant cryptographic primitives to ensure confidentiality, integrity, and authentication in the quantum era. This article explores the implications of PQC adoption for national security, including the challenges of transitioning legacy systems, potential vulnerabilities during migration, and the strategic importance of standardizing PQC protocols to safeguard military, governmental, and critical infrastructure communications. The article also discusses policy recommendations for governments to mitigate emerging quantum risks.