Search the blog
Somewhere in your inbox there is a supplier email warning that quantum computers will "break encryption" and that your business needs a quantum-safe strategy. The National Cyber Security Centre (NCSC) has indeed published a timeline: work out what you have by 2028, do the important migrations by 2031, finish everything by 2035 (NCSC, 2025). That sounds like a project with your name on it.
For most small and medium-sized businesses it is not, and the NCSC says so in the same document. If your firm runs on ordinary browsers, Windows or macOS, Microsoft 365 or Google Workspace and a mainstream VPN, the fix arrives as software updates from the companies that make those products. Part of it has already arrived: by October 2025 the majority of human web traffic through Cloudflare's network was protected against quantum attack, without anyone in a small office lifting a finger (Cloudflare, 2025). Here is the threat in plain terms, what has been fixed, what has not, and what is worth doing this year.
What a quantum computer would actually break
Almost every secure connection you use, from the padlock in the browser to a VPN tunnel, starts with public-key cryptography: one party publishes a key anyone can use to lock a message and keeps a private key that alone unlocks it. The common schemes rest on maths that ordinary computers cannot do in useful time: factorising very large numbers (RSA) or the discrete logarithm problem (Diffie-Hellman, ECDH, ECDSA and EdDSA, the elliptic-curve family behind most modern connections).
A large, error-corrected quantum computer, which the NCSC calls a cryptographically relevant quantum computer (CRQC), could solve those problems: "most traditional public key cryptography (PKC) algorithms in use today will be vulnerable to attack" (NCSC, 2024). Symmetric encryption, which scrambles the data itself once a key is agreed, is not broken in the same way; it needs bigger keys, not replacement. And nobody has built a CRQC. The NCSC timeline is not a forecast of when one will exist; it is a plan for replacing algorithms across a large estate, which takes longer than most people expect.
Harvest now, decrypt later
Why replace something that has not been broken? Because encrypted traffic can be recorded today and kept. Apple describes the scenario: attackers "collect large amounts of today's encrypted data and file it all away for future reference", then decrypt it once they have a quantum computer (Apple, 2024). The NCSC recognises the same risk of "an attacker collecting and storing data today and decrypting it at some point in the future" (NCSC, 2024).
This is why key exchange is being fixed first. Digital signatures, which prove a website or a software update is genuine, only matter at the moment they are checked; a quantum computer built in 2040 cannot retrospectively forge a signature you verified in 2026, but it can read a file you sent then. The NCSC adds a qualifier smaller firms should note: "such an attack is only likely to be worthwhile for very high-value information" (NCSC, 2024).
The new standards
The replacements exist. On 13 August 2024 the US National Institute of Standards and Technology (NIST) published three Federal Information Processing Standards after a public competition that began in 2016 (NIST, 2024):
- FIPS 203, ML-KEM (from CRYSTALS-Kyber): the primary standard for key exchange.
- FIPS 204, ML-DSA (from CRYSTALS-Dilithium): the primary standard for digital signatures.
- FIPS 205, SLH-DSA (from SPHINCS+): a second signature scheme, "intended as a backup method in case ML-DSA proves vulnerable".
On 11 March 2025 NIST added HQC, a key-exchange scheme built on error-correcting codes rather than lattices, as insurance against a mathematical breakthrough against ML-KEM; a final standard is expected in 2027 (NIST, 2025). NIST told administrators to start using the 2024 standards "immediately, because full integration will take time" (NIST, 2024). The people who write cryptographic libraries and products have acted on it.
Where post-quantum cryptography already is
The pattern everywhere is a hybrid: a classical algorithm and a post-quantum one run together, so an attacker must break both. The NCSC calls this "an interim measure" on the way to post-quantum-only systems, but it is what ships today (NCSC, 2024).
- The web. Browsers and servers now agree keys with X25519MLKEM768, a hybrid of the elliptic-curve X25519 and ML-KEM. Cloudflare reported on 28 October 2025 that "recent versions of all major browsers" enable it by default and that the majority of human-initiated traffic on its network used post-quantum key agreement (Cloudflare, 2025).
- Messaging. Apple's iMessage moved to its PQ3 protocol with iOS 17.4 and macOS 14.4 in 2024, using Kyber for key establishment (Apple, 2024).
- Remote administration. OpenSSH 10.0 (9 April 2025) made the hybrid mlkem768x25519-sha256 the default key agreement; OpenSSH 10.1 (6 October 2025) added a warning whenever a connection falls back to a non-post-quantum algorithm, citing "store now, decrypt later" (OpenSSH, 2025).
- Windows and Microsoft 365. Microsoft has ML-KEM and ML-DSA in SymCrypt, the library beneath Windows, Azure and Microsoft 365, and aims for early adoption by 2029 and a complete transition of its products and services by 2033 (Microsoft, 2025).
What is missing is the certificate: every HTTPS site still proves its identity with RSA or elliptic-curve signatures. Cloudflare's summary is that much traffic uses post-quantum key agreement "but not a single public post-quantum certificate is used"; the first will appear in 2026 but are unlikely to be broadly trusted before 2027 (Cloudflare, 2025). Since signatures are not exposed to harvest-now-decrypt-later, that is the right order.
What a small business actually depends on
For a typical 10 to 50-seat firm the picture is reassuring. The NCSC's timeline is written for "large organisations, operators of critical national infrastructure" and "companies that have bespoke IT"; for SMEs on commodity IT it says migration "should happen seamlessly, as services are updated by their vendors" (NCSC, 2025).
| Your system | Who fixes it | Where it stands | What you do |
|---|---|---|---|
| Web browsing (Chrome, Edge, Firefox, Safari) | Browser vendors and website hosts | Hybrid key exchange on by default; PQ certificates expected 2026–2027 | Keep browsers updating automatically |
| Microsoft 365, Windows, Azure | Microsoft | Algorithms in SymCrypt now; full transition targeted for 2033 | Stay on supported Windows versions; keep patching |
| Google Workspace and other cloud apps | The provider | Delivered through their TLS stack | Ask for the vendor's PQC statement at renewal |
| iPhone and Mac messaging | Apple | PQ3 shipped in iOS 17.4 and macOS 14.4 | Keep devices on current OS releases |
| VPN and firewall | Your firewall/VPN vendor | Varies; typically firmware updates | Check the roadmap; replace end-of-life boxes |
| Server administration over SSH | OpenSSH project and your Linux distribution | Default since OpenSSH 10.0 | Update servers; heed the 10.1 warning |
| Backups and archives | Your backup vendor, plus you | Data at rest uses symmetric keys; the exposure is in transit | Confirm encryption at rest and TLS in transit |
| Line-of-business or bespoke software | The developer | Often the laggard | Ask when they will move off RSA/ECC key exchange |
The bottom row is where the NCSC's warnings apply. Old accounting packages, custom integrations and unmaintained hardware will not fix themselves; those still running them will "end up running significant legacy estates, with the risks that this will entail" (NCSC, 2025).
What to do this year
- Keep everything current. For commodity IT the migration arrives through the update channels you already have; a machine on an unsupported Windows or an unpatched firewall misses it. See business IT support and cloud services.
- Make a one-page list. The NCSC's 2028 milestone is "a full discovery exercise" of what depends on cryptography, "not intended to be a formal asset register" (NCSC, 2025). For a small firm: which cloud services, VPN, website host, backup product and bespoke or legacy applications you use.
- Ask each vendor one question. The NCSC tells system owners to "communicate with their IT system suppliers about their plans for supporting PQC in their products" (NCSC, 2024). At renewal, ask when the product will use the NIST standards for key exchange.
- Do not buy a box. Nothing you can purchase this year makes a standard office quantum-safe faster than the vendors will. The NCSC says plans should not involve you, nor most of your suppliers, "producing your own implementations of post-quantum cryptography" (NCSC, 2025). Treat proprietary quantum-safe appliances and bank-priced readiness assessments with suspicion.
- Prefer agility. When you replace a firewall, VPN or line-of-business system, ask whether it can swap algorithms by configuration. The NCSC calls this cryptographic agility, "the ability to readily support alternative suites of cryptographic algorithms" (NCSC, 2025).
What not to worry about
You do not need to re-encrypt existing backups, rotate every password or stop using cloud email. Encryption at rest is not the target, and the harvest-now-decrypt-later risk is, in the NCSC's assessment, worth an attacker's while only for very high-value information (NCSC, 2024). Nor is 2035 the year quantum computers arrive; it is the year the UK wants the replacement finished, and most of that job is being done by the companies whose software you rent.
If you are unsure which of your systems fall into the bottom row of the table, get in touch and we will help you build the list.
Sources
- Apple (2024) iMessage with PQ3: The new state of the art in quantum-secure messaging at scale. Apple Security Engineering and Architecture, 21 February 2024. https://security.apple.com/blog/imessage-pq3/ (accessed 25 August 2026).
- Cloudflare (2025) State of the post-quantum Internet in 2025. Cloudflare blog, 28 October 2025. https://blog.cloudflare.com/pq-2025/ (accessed 25 August 2026).
- Microsoft (2025) Quantum-safe security: Progress towards next-generation cryptography. Microsoft Security blog, 20 August 2025. https://www.microsoft.com/en-us/security/blog/2025/08/20/quantum-safe-security-progress-towards-next-generation-cryptography/ (accessed 25 August 2026).
- NCSC (2024) Next steps in preparing for post-quantum cryptography, version 2.0. National Cyber Security Centre, August 2024. https://www.ncsc.gov.uk/whitepaper/next-steps-preparing-for-post-quantum-cryptography (accessed 25 August 2026).
- NCSC (2025) Timelines for migration to post-quantum cryptography. National Cyber Security Centre, 20 March 2025. https://www.ncsc.gov.uk/guidance/pqc-migration-timelines (accessed 25 August 2026).
- NIST (2024) NIST Releases First 3 Finalized Post-Quantum Encryption Standards. National Institute of Standards and Technology, 13 August 2024. https://www.nist.gov/news-events/news/2024/08/nist-releases-first-3-finalized-post-quantum-encryption-standards (accessed 25 August 2026).
- NIST (2025) NIST Selects HQC as Fifth Algorithm for Post-Quantum Encryption. National Institute of Standards and Technology, 11 March 2025. https://www.nist.gov/news-events/news/2025/03/nist-selects-hqc-fifth-algorithm-post-quantum-encryption (accessed 25 August 2026).
- OpenSSH (2025) OpenSSH Release Notes: 10.0 (9 April 2025) and 10.1 (6 October 2025). OpenBSD Project. https://www.openssh.org/releasenotes.html (accessed 25 August 2026).