Quantum computing could be coming in as little as three years, threatening to undermine the encryption that protects modern communication, transactions and data. Adding to this risk, cyber criminals are already harvesting sensitive data in anticipation of quantum hardware capable of unlocking it in future. Organisations must take action now to safeguard systems and data and achieve ‘quantum agility’.
This is according to post-quantum cryptography (PQC) experts who were speaking during a recent webinar on PQC laws and standards, hosted by the Institute of Information Technology Professionals South Africa (IITPSA) cyber security special interest group (SIGCyber).
Blair Canavan, Director Alliances, PKI and PQC Portfolio at Thales, noted that fully useful, fault-tolerant commercial quantum computers are projected to arrive within just a few years, with the likes of IBM investing more than US$10 billion in coming years in an effort to deliver the first large-scale fault-tolerant quantum computer by 2029.
He said: “We are moving nearer to cryptographically relevant quantum computing than ever before, with enough logical qubits to crack standard public key encryption.”
EG Nadhan, Chief Quantum Ambassador at QuantaCyber and chair of the board at HDF Group, highlighted risks like ‘harvest now, decrypt later’ relating to stolen encrypted data, and ‘trust now, forge later’ threatening digital signatures and certificates that are trusted today.
“Future quantum computers will break today’s digital signatures like RSA and ECC. Hackers will then fake software updates, identity certificates and system commands. This threatens system safety and trust more than data theft,” he said.
Time for action
Nadhan said: “With new types of risk, there is always a wait-and-see attitude. But if everyone is waiting, that's where national guidelines and standards help. These guidelines should be prescriptive about what needs to be done and how to do it, with processes and milestones. Without proper guidelines, there will be a chaotic last-minute scramble that will increase the risk, not mitigate it.
“The time to work on this is now,” he warned. “The issue for the board is that the time that it takes to encrypt assets with quantum resistant algorithms is greater than the time it will take hackers to crack the algorithms. They are at risk of losing this game of chess.”
They noted that simply patching systems was not an ideal solution, and that the strategic approach should be achieving crypto agility.
Nadhan said quantum resistance is not achieved when PQC is rolled out, but when quantum-vulnerable solutions are deprecated. Migration is only complete when legacy cryptography has been identified, managed, retired and replaced across the enterprise and its wider ecosystem, according to the US Department of War Post-Quantum Cryptography guidance.
Canavan said: “The migration time is the bottleneck in achieving post-quantum readiness. Inventory, interoperability testing, PKI alignment and partner co-ordination, which can take years. At the same time, boards, regulators and partners will want crypto inventories, heatmaps and execution artefacts before full migration is complete.”
He said Thales saw 2026 as the year of action, advising organisations to build crypto agility so they could adopt new profiles without disruption; protect sensitive data and critical networks while migrations progress; and ensure that they stay compliant and auditable. They should execute in partnership with an ecosystem of GSIs, PLIs and cloud and platform partners, he said.
Post-quantum standards
Nadhan highlighted international developments such as US President Donald Trump signing two executive orders in June this year to accelerate the federal government’s transition to post-quantum encryption and reprioritise government financing to support the domestic quantum computing industry; as well as an order for federal civilian networks to adopt quantum-resistant encryption sooner than the 2035 deadline. France’s cyber security agency ANSSI – Agence nationale de la sécurité des systèmes d'information – will stop certifying security products that lack quantum-resistant encryption starting in 2027, effectively accelerating the country’s transition to post-quantum cryptography.
Meanwhile, NIST has published final post-quantum cryptographic standards, now extending to federal identity credentials.
Canavan said: “Standards are constantly evolving, but the world owes NIST a debt of gratitude – it took it all under one roof and I am confident most organisations around the world will follow their standards. This is a genuinely good sign of collaboration around the world. The NIST National Cybersecurity Center of Excellence, open to all industry and governments, has generated momentum in cryptographic discovery.”
He added: “All the regulations and executive orders are coming, but organisations shouldn’t wait for these. I am optimistic that we are seeing a shift in attitudes around the world, and a growing acceptance that getting a post-quantum plan in place is important. Procurement of both hardware and software must change, with anything you acquire being quantum safe today and in future.”
Webinar moderator Kholofelo Halefose, Chief Advisor in Cybersecurity at Eskom and IITPSA SIGCyber committee member, concluded: “PQC has become an important boardroom and regulatory discussion. Organisations that begin preparing today will be better placed to build resilient organisations in future.”
The Institute of Information Technology Professionals South Africa (IITPSA), the South African ICT industry professional body, hosts topical knowledge-sharing events throughout the year. Among the IITPSA’s flagship initiatives are the IITPSA President’s Awards and the inaugural IITPSA Workforce Intelligence Conference, which will be staged at Emperor’s Palace in Johannesburg on 30 October. At this event, the findings of 2026 IITPSA ICT Skills Survey will be released, outlining the impacts of AI on ICT recruitment and workforces in South Africa. To learn more and register, go to https://www.iitpsa.org.za/conference2026/.
Share
Editorial contacts