The prospect that a cryptographically relevant quantum computer (CRQC) could eventually compromise RSA (Rivest–Shamir–Adleman) and elliptic-curve cryptography presents organizations with a complex investment decision under substantial technological and economic uncertainty. This paper examines organizational responses to post-quantum cryptography (PQC) investment through qualitative thematic analysis of a purposive corpus of practitioner and executive position statements, triangulated with peer-reviewed research and technical and governance literature on PQC migration, cryptographic agility, and the harvest-now-decrypt-later (HNDL) threat. Findings reveal broad convergence toward a phased preparation strategy centered on cryptographic agility, rather than immediate large scale replacement or passive deferral. The analysis indicates that data confidentiality lifespan is a more actionable risk variable than the uncertain timing of CRQC availability, while financial, operational, and interoperability constraints limit the practicality of wholesale migration. The paper contributes a stakeholder aware decision framework and practical phased actions, including cryptographic inventory, data classification by confidentiality lifetime, hybrid deployment, vendor accountability, and agile security architectures, to support organizational leaders and boards in making defensible PQC investment decisions under continuing uncertainty.
The prospect that a cryptographically relevant quantum computer (CRQC) could eventually compromise RSA (Rivest–Shamir–Adleman) and elliptic-curve cryptography presents organizations with a complex investment decision under substantial technological and economic uncertainty. This paper examines organizational responses to post-quantum cryptography (PQC) investment through qualitative thematic analysis of a purposive corpus of practitioner and executive position statements, triangulated with peer-reviewed research and technical and governance literature on PQC migration, cryptographic agility, and the harvest-now-decrypt-later (HNDL) threat. Findings reveal broad convergence toward a phased preparation strategy centered on cryptographic agility, rather than immediate large scale replacement or passive deferral. The analysis indicates that data confidentiality lifespan is a more actionable risk variable than the uncertain timing of CRQC availability, while financial, operational, and interoperability constraints limit the practicality of wholesale migration. The paper contributes a stakeholder aware decision framework and practical phased actions, including cryptographic inventory, data classification by confidentiality lifetime, hybrid deployment, vendor accountability, and agile security architectures, to support organizational leaders and boards in making defensible PQC investment decisions under continuing uncertainty.
Quantum computing poses an existential threat to public-key cryptography, with Shor's algorithm capable of breaking RSA and elliptic curve systems once cryptographically relevant quantum computers (CRQCs) emerge. While post-quantum cryptography (PQC) offers algorithmic solutions, organizational readiness extends beyond technical implementation to encompass governance, interoperability, and adaptive capacity. This review synthesizes the quantum threat landscape, evaluates NIST-standardized PQC algorithms through quantitative performance analysis, and examines global standardization dynamics. We introduce a novel Quantum Readiness Maturity Model (QRMM) that enables organizations to assess and advance their preparedness across five dimensions: cryptographic infrastructure, governance frameworks, sectoral adaptation, interoperability resilience, and strategic agility. Applying this model to finance, telecommunications, and defense sectors reveals systematic gaps in migration planning and crypto-agility. Our analysis demonstrates that quantum readiness requires treating cryptographic transformation as a strategic enterprise capability rather than a purely technical upgrade. The proposed framework provides actionable pathways for practitioners while identifying critical research directions in hybrid deployment strategies, post-quantum PKI architectures, and algorithmic diversity.
Financial institutions depend on RSA, elliptic-curve cryptography, and Diffie-Hellman key exchange for authentication, transaction integrity, and confidentiality: algorithms a sufficiently large quantum computer would break outright rather than merely weaken. No cryptographically relevant quantum computer exists yet, but the harvest-now-decrypt-later threat means data intercepted today remains at risk once one does, and financial data's long retention obligations make this a present-day planning problem rather than a distant one. This paper assesses the readiness of financial institutions in Africa to adopt post-quantum cryptography (PQC) and develops a framework for transitioning to quantum-resistant cryptographic systems. Five specific objectives drive that work: examining PQC awareness among African financial institutions, assessing current cryptographic exposure, identifying technical, financial, organizational, regulatory, and skills-related adoption barriers, evaluating the suitability of finalized PQC algorithms for financial applications, and developing a readiness and migration framework fitted to African constraints. The study's design is literature-based and conceptual: it synthesizes verified secondary evidence rather than reporting original fieldwork, and no institution was surveyed or interviewed. Its contributions include an integrated Technology-Organization-Environment/Diffusion-of-Innovation model with crypto-agility as a mediating capability, a six-dimension readiness instrument, and an algorithm-evaluation framework. The central contribution, a six-phase migration framework addressing three gaps found in every existing precedent, is paired with an adapted risk-based prioritization matrix. Headline recommendations call on institutions to name a single accountable owner and begin scoped discovery now, on regulators to extend draft cybersecurity guidance to address cryptographic agility explicitly, and on future research to empirically test the proposed model against real institutions.
Quantum computing is no longer a distant concern for cybersecurity planning. Its progress has raised serious questions about the long-term reliability of widely used public-key cryptographic systems, especially RSA, elliptic curve cryptography, and related key exchange mechanisms that currently protect digital communication, cloud services, financial transactions, government systems, and enterprise information assets. The main concern is that powerful quantum algorithms could weaken the mathematical assumptions on which these systems depend, creating future risks for encrypted data, digital signatures, identity systems, and secure network protocols (Shor, 1994; Mosca, 2018). Post-quantum cryptography has therefore become a major cybersecurity readiness priority, not only as a technical replacement for vulnerable algorithms, but as a broader organizational migration challenge. Effective preparation requires cryptographic asset inventory, risk classification, crypto-agility, vendor coordination, interoperability testing, and phased deployment across complex information systems (Kumar, 2022; Campbell, 2025). This article examines the cybersecurity implications of quantum computing and reviews the major post-quantum cryptographic algorithm families, current standardization efforts, enterprise migration barriers, and strategic readiness measures needed for the quantum computing era. It also discusses the importance of aligning post-quantum migration with existing cybersecurity governance, information systems management, and long-term digital resilience planning. By emphasizing early preparation, structured migration, and continuous cryptographic governance, the article argues that organizations can reduce future quantum-related exposure and strengthen the security of critical digital infrastructure before large-scale quantum attacks become practical (NIST, 2024; NCCoE, 2025).
The imminent maturation of Cryptographically Relevant Quantum Computers (CRQCs) represents a fundamental threat to the digital security infrastructure, specifically targeting modern cryptographic standards such as AES, RSA and Elliptic Curve Cryptography (ECC). While Post -Quantum Cryptography (PQC) offers a mathematical defense, the transition is complicated by the “Harvest Now, Decrypt Later ” (HNDL) strategy, where encrypted data is intercepted today for future decryption. This thesis explores the critical necessity of an organized migration strategy to protect long-term data sensitivity against the rapid advancement of quantum capabilities and addresses the gaps in the current migration landscape: the absence of a standardized, risk -based prioritization methodology, the absence of an AI based prioritization system to accommodate the approximate nature of variables involved, and a comparison of both the implementations. Finally, the technical deadlock surrounding non -upgradable legacy systems. Current literature often lacks a semi-quantified approach that uses data criticality as the primary criterion for migration triage. This thesis covers the void by introducing a framework supported by a custom software tool based on that assigns numerical priority scores based on data shelf -life and organizational risk and also implements the prioritization using Fuzzy Logic and them comparing the results of the two implementations to see which platform better suits the problem . Furthermore, the thesis tackles the challenge of legacy hosts that cannot support NIST-standardized algorithms, proposing a crypto -agile architectural solution that utilizes intermediate VPN terminals and SSH tunnels to wrap vulnerable traffic in quantum -resistant encryption. The results of this thesis demonstrate that a structured, data -centric approach can successfully mitigate quantum risk even in complex enterprise environments , furthermore it determines how a Fuzzy Logic based implementation better suits the approximate nature of the problem. Experimental validation through the “corp.com” simulation showed that implementing the proposed PQC -based SSH VPN reduced legacy host exposure to near zero while maintaining high operational performance. Despite the inherent computational overhead of PQC algorithms, the hybrid implementation experienced only a 15.7% increase in average round -trip time for 100 packets, significantly outperforming the 20% speed loss typically associated with hybrid PQC over networks. These findings provide a scientific and repeatable basis for organizational leaders to direct resources toward quantum-safe encryption without compromising network efficiency.
Purpose: The purpose of this paper is to examine the emerging threat that large-scale quantum computing poses to classical public-key cryptographic systems, particularly RSA and Elliptic Curve Cryptography (ECC), which form the backbone of contemporary digital security infrastructures. In response to this threat, the study aims to analyze post-quantum cryptography (PQC) as a viable long-term solution capable of resisting both classical and quantum adversaries. The paper further seeks to assess the urgency of PQC adoption in light of the “harvest now, decrypt later” threat model and to evaluate the practical readiness of quantum-safe cryptographic algorithms currently under consideration by the National Institute of Standards and Technology (NIST). Materials and Methods: This study employs a qualitative and analytical research methodology grounded in an extensive review of authoritative sources, including NIST’s post-quantum cryptography standardization documents, recent academic literature, industry white papers, and policy reports from organizations such as RAND Corporation and Cloudflare. The analysis systematically surveys major families of post-quantum cryptographic algorithms namely lattice-based, code-based, and hash-based schemes and evaluates them based on security assumptions, computational efficiency, implementation complexity, and standardization maturity. Findings: The analysis indicates that Lattice-based cryptographic schemes demonstrate the highest maturity and practical readiness, evidenced by their selection in NIST’s PQC process. Code- and hash-based methods provide strong security but face key size and performance challenges. The lack of scalable quantum computers does not reduce urgency, as data harvesting persists. Artificial intelligence emerges as a key enabler for accelerating PQC adoption. Unique Contribution to Theory, Practice and Policy: The paper recommends a proactive, phased post-quantum migration using hybrid cryptographic architectures. Organizations should conduct inventories, benchmarking, and pilot deployments aligned with NIST standards. AI-driven tools are advised to improve key management and reduce complexity. Continued interdisciplinary research and policy support are encouraged to ensure a secure, scalable transition to quantum-resistant security systems.
Quantum computing threatens the security foundations of global financial systems, exposing long-lived data and signed digital assets to “harvest-now, decrypt-later” attacks. While the timeline for cryptographically relevant quantum computers remains uncertain, regulatory signals from the USA, UK, EU, Canada, and Australia converge: financial institutions and payment infrastructures must begin migrating to post-quantum cryptography (PQC) now to preserve confidentiality, integrity, and systemic stability. This paper maps emerging standards and roadmaps, contrasting binding requirements like the EU’s DORA crypto-agility provisions with non-binding guidance from NIST, ENISA, and ETSI. Despite a shared intent to secure high-risk use cases by 2030–2031 and complete migration by 2035, divergences in enforcement and milestones create uncertainty for cross-border banks and financial market infrastructures. In parallel, technical adoption is advancing: major browsers, cryptographic libraries (OpenSSL/BoringSSL), and CDNs (e.g., AWS CloudFront) have deployed hybrid PQC key exchange in TLS 1.3, proving confidentiality defenses are viable at internet scale. The paper synthesizes historical transition lessons, sector-specific regulatory drivers, and operational constraints in payment infrastructures to derive a new, principle-based migration: crypto-agility, risk-prioritized scoping, hybrid deployment, vendor and supply-chain alignment, independent testing, and proactive supervisory engagement. Acting now reduces long-tail exposure and ensures readiness for imminent compliance and interoperability deadlines.