Over half of firms prepare for post-quantum cryptography shift

Over half of organisations in the United States, United Kingdom and Germany are making progress towards readiness for post-quantum cryptography (PQC) migration, according to a new survey from Utimaco.

The survey, conducted with more than 200 organisations across three countries, examines the current status and timelines for PQC migration, as well as preferred migration strategies and common barriers.

With quantum computers expected to break common public key encryption schemes by 2030, the urgency to address PQC has become more pressing for IT security professionals. The so-called "Q-Day"—when malicious actors could exploit these new quantum capabilities - would require a shift in the existing cryptographic landscape.

According to the survey's findings, 20% of organisations reported they have already begun migrating to PQC. A further 34% plan to start the process in the next one to three years. Another 21% expect to embark on PQC migration within three to five years, aligning their efforts with the anticipated timeline for quantum threats.

The data also indicates that a quarter of respondents have no current plans to migrate to PQC, highlighting that some sectors may still be assessing the requirements and impact of such a transition.

Migrating to PQC is described by respondents as a significant transformation requiring substantial changes to cryptographic infrastructure across various use cases. Adoption of new cryptographic algorithms poses challenges for legacy systems, especially due to larger key sizes and differences in technical implementation compared to current systems.

The survey reveals that most organisations that have begun planning for PQC are gravitating towards a hybrid cryptographic approach, with 63% favouring a mix of classical and post-quantum cryptographic technologies. This approach aims to combine familiar systems with newer methods for enhanced security during the migration phase.

A range of other strategies are evident among participants. Twenty-six percent view larger symmetric key sizes as a viable defensive measure, while 17% plan to implement full PQC solutions. Twelve percent intend to use Quantum Key Distribution (QKD) as an additional security measure. Another 20% selected none of these or other unspecified methods, which could include utilising larger asymmetric key sizes or adhering to guidance from national cyber security agencies.

Cindy Provin, Chief Strategy Officer at Utimaco, commented on the findings, stating: "The reality is that quantum threats aren't far away. At Utimaco, we're working closely with customers and partners like NIST to provide solutions that ease the path to post-quantum readiness, and our survey showcases progress towards that goal. While there is still a portion of organizations out there that lack a plan for the road to PQC readiness, we are hard at work to ensure access to easy-to-implement solutions with the latest algorithms to help them - and our customers - on this journey."

The survey results reflect a varied landscape of preparedness among organisations as the anticipated arrival of quantum computing capabilities draws closer. Many are taking a proactive approach to ensuring future-proof security, but other groups remain in the evaluation phase or undecided about their next steps.